Thought Leadership
France’s Ministry of Finance has confirmed a data breach at the French tax authority DGFiP involving personal and corporate data belonging to 678,000 individuals and companies.
The incident came to light after an attacker operating under the name ZeroBytes offered a stolen database for sale on the PwnForums hacking forum on August 12. According to the Finance Ministry’s own investigation, the compromised account was used to access tax information on up to 678,000 individuals and companies before access was blocked. The exposed data included reference income, the household quotient used for tax calculations, and withholding tax rates. For companies, the data also included business names and SIREN registration numbers. Cadastral information, including addresses and property sizes, was also affected.
The ministry emphasized that the online accounts of individual and business customers were not compromised. Usernames and passwords were not affected.
Attacker Claims Access to Cadastral Data
In the hacking forum, the attacker claimed to have gained access through the Serveur Professionnel de Données Cadastrales, a portal providing centralized cadastral and property data for around 20 million French citizens.
According to the attacker, 252,149 records containing information on more than 2 million people were stolen before the full data extraction was abandoned because it was considered too time-consuming. After discovering the attack, the DGFiP blocked access to the affected sensitive systems and notified France’s data protection authority CNIL and national cybersecurity agency ANSSI, which is supporting the ongoing investigation.
Fourth Known Data Breach at a French Government Agency
The Finance Ministry said it will begin contacting all affected individuals by email or letter next week. Those notifications will explain which specific data was exposed and outline the necessary precautions. The incident is the latest in a series of cyberattacks targeting French government agencies in recent months. In January, France’s data protection authority fined the national employment agency France Travail €5 million after attackers stole personal data belonging to 43 million people.
A month later, the Finance Ministry reported another data breach involving more than 1.2 million accounts in FICOBA, the country’s national bank account registry. Most recently, France Titres, the agency responsible for identity documents, confirmed a data breach after an attacker offered a database allegedly containing 19 million records from the systems of ANTS, France’s national agency for secure documents, for sale.
(Editorial Team)
