French tax authority says break-in exposed data of 600K, including some private messages
France's General Directorate of Public Finances (DGFiP) has confirmed that a break-in exposed the data of roughly 600,000 taxpayers and businesses, with the actual contents of private messages compromised for around 250 people. The update follows last week's disclosure of the attack, in which a hacker known as "ZeroBytes" claimed to have stolen data belonging to more than 2 million individuals, though DGFiP has not explained the discrepancy between that figure and its own lower tally. The breach adds to a difficult year for French public-sector cybersecurity, raising concerns that stolen details could be used to craft convincing phishing and impersonation scams.
Slightly more than 350,000 individuals had data exposed, including tax identification numbers, marital status, contact details, household composition, dependants, and withholding rates, while lists of messages exchanged with the tax authority were also compromised. Around 250,000 businesses had only company names and SIREN numbers exposed, and cadastral data was limited to already-public property information. DGFiP is notifying affected taxpayers by email or post this week and has warned of possible CEO fraud, impersonation and fake bank adviser scams, stressing it will never request sensitive details by phone, text or email. Separately, the authority disclosed and suspended a vulnerable Vacant Successions Portal, though no data leak has yet been confirmed there.
- French tax authority DGFiP confirms breach affecting about 600,000 people
- Roughly 250 people had actual private message contents stolen
- Follows a torrid year of French public-sector data breaches
New here? Start with this
France’s General Directorate of Public Finances (DGFiP) handles tax records for individuals and businesses. Those records include personal details used to calculate tax, as well as information about companies and property.
Tax identification and household details can help officials administer taxes, but they could also help a scammer make a message or phone call seem genuine. Businesses are identified by SIREN numbers, while some property records are public. The reported incident also involved lists of messages sent to the tax authority, and the contents of messages for a smaller number of people.
The case matters because stolen details can be used in impersonation and payment scams, including messages pretending to come from a bank or business leader. French authorities have faced other public-sector cybersecurity concerns this year, making the security of government-held information a wider issue.