A French tax agency breach may have exposed personal information belonging to 678,000 people. France’s General Directorate of Public Finances, known as DGFiP, confirmed that attackers accessed its systems in late June and early July 2026.
The agency said the intruders could view and extract information from affected people. However, investigators have not yet confirmed exactly which data attackers accessed or how many people and businesses the incident ultimately affected.
DGFiP said it will notify affected victims later this week.
Sophisticated attack bypassed initial checks
DGFiP detected the unauthorised access and immediately blocked the accounts involved in the incident. However, the agency said its first access-control checks did not reveal that attackers had stolen data.
French officials said the attack’s sophistication allowed the intruders to avoid detection during those initial checks. The agency later identified the potential data theft as its investigation developed.
Following the breach, DGFiP introduced additional security measures to prevent similar incidents. It is now investigating the attack with France’s National Agency for the Security of Information Systems, known as ANSSI, and the Senior Defence and Security Official service.
Officials have not confirmed the stolen data
The French tax authority has not publicly identified the exact data exposed in the breach. It is still assessing the information attackers accessed and the full scope of the incident.
That uncertainty means affected people should remain alert for phishing attempts, fraudulent calls and other scams. Tax-related records can give criminals enough personal context to create highly convincing messages.
DGFiP has not attributed the incident to a specific threat actor.
Hacker claims far larger theft
A threat actor using the name ZeroBytes has claimed responsibility for the attack, according to French breach-tracking website FrenchBreaches.
The hacker claimed to have extracted 252,149 lines of information connected to more than two million people. The claimed number is far higher than the 678,000 people cited by DGFiP.
The attacker also allegedly shared a sample of the data. According to the report, the sample included names, dates of birth, postal addresses, phone numbers, email addresses, income details and cadastral information.
However, DGFiP has not confirmed the threat actor’s claims. The reported data sample and the alleged number of affected people remain unverified by the agency.
France faces continued public-sector breaches
The French tax agency breach is the latest cyber incident to affect a public institution in the country.
Earlier in 2026, the National Agency for Secure Titles confirmed an exposure involving a database containing about 19 million records. Hackers also targeted France Travail, the French Interior Ministry and the FICOBA banking database.
The pattern shows why public agencies remain a major target for cybercriminals. These organisations hold large volumes of personal, financial and identity-related data that can support fraud and phishing campaigns.
Conclusion
The French tax agency breach may have exposed data from 678,000 people, although investigators still need to determine the full impact. Anyone contacted about taxes or government services should verify messages through official channels before sharing personal information.
0 responses to “French tax agency breach may expose 678,000 people”