French tax authority breach exposes data of up to 700,000 taxpayers — The Debate
A cyberattack on the DGFiP has led to the theft of personal and professional tax records, raising concerns across Europe about public‑sector cybersecurity.
A cyber intrusion into France's tax administration has resulted in the theft of personal data belonging to nearly 700,000 individuals and businesses. The group calling itself ZeroBytes announced on 12 August that it had accessed the systems of the Directorate General of Public Finances (DGFiP), which operates the impots.gouv.fr portal, after obtaining stolen credentials.
The Ministry of the Economy and Finance confirmed that the intrusion was detected during routine security checks in late June and that data had already been extracted. An independent monitoring platform, FrenchBreaches, estimates that around 678,000 records were taken, covering roughly 393,000 private individuals and 286,000 professionals.
Extracted information includes names, addresses, dates of birth, tax reference numbers, withholding rates, family status and, in some cases, property details. The dataset also contains internal tax identifiers, the number of dependants and a history of interactions with the tax authority. The stolen files have reportedly been offered for sale for several thousand euros.
Such a large‑scale breach highlights the vulnerability of public‑sector databases that many EU member states rely on for tax collection and social services. It may prompt other governments to reassess their own security protocols, especially as cross‑border data sharing becomes more common under EU fiscal cooperation schemes.
In response, the ministry is working with the Agence nationale de la sécurité des systèmes d'information (ANSSI) to determine the full extent of the compromise and to tighten access controls. Affected taxpayers will be notified individually with advice on protecting their personal information.
The incident will be reported to the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), and a formal complaint will be filed. Prime Minister Sébastien Lecornu has previously pledged a €200 million cybersecurity plan funded by the France 2030 programme, a move that may now be accelerated to address the growing threat landscape.