France’s tax authority, DGFiP, has confirmed that an intruder accessed its systems in late June and extracted data, after a cybercriminal using the alias ZeroBytes advertised an alleged database of two million taxpayers. The authority says the access was cut off during an audit at the end of June and disputes the attacker’s claim of retaining system access, while investigators establish the scale of the breach and notify those affected.

ZeroBytes claimed to have used stolen credentials and an MFA-bypass technique, but DGFiP has not verified the claimed number of records or the precise data involved. The agency will report the incident to France’s data-protection regulator, CNIL; it follows several major public-sector breaches this year, including thefts involving bank details, health records and identity-document data.