French Tax Authority Confirms Data Breach Affecting 600,000 Taxpayers and Businesses
France’s General Directorate of Public Finances (DGFiP) has revealed that a recent cyberattack exposed sensitive data belonging to approximately 600,000 individuals and businesses. The breach, first acknowledged last week, involved the theft of messages exchanged between the tax authority and around 250 taxpayers, along with personal and financial details of hundreds of thousands more.
The compromised data includes tax identification numbers, marital status, email and postal addresses, phone numbers, household composition, dependents, reference tax income, and withholding rates. For roughly 250,000 businesses and professionals, the exposed information was limited to company names and SIREN numbers the unique nine-digit identifiers for French enterprises. Additionally, cadastral data, such as property addresses and dimensions, was accessed, though DGFiP noted this information was already publicly available.
The attack was claimed by a cybercriminal known as "ZeroBytes," who initially alleged the theft of data belonging to over 2 million individuals a figure far exceeding the DGFiP’s confirmed count. The authority has not explained the discrepancy between its reported numbers and the attacker’s claims.
DGFiP is notifying affected parties via email or post, warning that the stolen data could be used in phishing scams, impersonation attempts, and fraudulent schemes, including bogus bank adviser scams. The authority emphasized that it will never request sensitive information, such as PINs or identity documents, via phone, text, or email, directing taxpayers to use its secure portal for such communications.
In a separate incident, DGFiP disclosed a "technical vulnerability" in the government’s Vacant Successions Portal (PSV), which helps locate estates without known heirs. The service was suspended after the flaw was discovered, though no evidence of data leakage has been found so far.
The breach adds to a series of cybersecurity incidents plaguing France’s public sector this year. In February, the finance ministry reported a breach affecting 1.2 million citizens’ bank details. March saw the Health Ministry confirm the theft of 15.8 million administrative files including 165,000 containing doctors’ notes from healthtech firm Cegedim Santé. In April, a 15-year-old allegedly breached France Titres, the agency handling identity documents, claiming to have exposed data on up to 19 million people. June brought reports of an alleged breach of Tchap, the government’s encrypted messaging platform, with attackers claiming access to 73,000 user accounts and hundreds of thousands of messages.
Business France Healthcare - North America cybersecurity rating report: https://www.rankiteo.com/company/business-france-healthcare
Direction générale du Trésor cybersecurity rating report: https://www.rankiteo.com/company/direction-generale-du-tresor-french-treasury
LaSuite cybersecurity rating report: https://www.rankiteo.com/company/la-suite-gouv
French Ministry for Armed Forces cybersecurity rating report: https://www.rankiteo.com/company/french-ministry-of-armed-forces
"id": "BUSDIRLA-FRE1787230375",
"linkid": "business-france-healthcare, direction-generale-du-tresor-french-treasury, la-suite-gouv, french-ministry-of-armed-forces",
"type": "Breach",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '600,000 individuals and '
'businesses',
'industry': 'Public Sector/Taxation',
'location': 'France',
'name': 'General Directorate of Public Finances '
'(DGFiP)',
'type': 'Government Agency'}],
'customer_advisories': 'Warning about potential phishing scams, impersonation '
'attempts, and fraudulent schemes',
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': '600,000',
'personally_identifiable_information': 'Tax identification '
'numbers, marital '
'status, email and '
'postal addresses, '
'phone numbers, '
'household '
'composition, '
'dependents, reference '
'tax income, '
'withholding rates',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personal Identifiable '
'Information',
'Financial Information',
'Business Identifiers',
'Cadastral Data']},
'description': 'France’s General Directorate of Public Finances (DGFiP) '
'confirmed a cyberattack that exposed sensitive data belonging '
'to approximately 600,000 individuals and businesses. The '
'breach involved the theft of messages exchanged between the '
'tax authority and around 250 taxpayers, along with personal '
'and financial details of hundreds of thousands more.',
'impact': {'brand_reputation_impact': 'High',
'data_compromised': 'Tax identification numbers, marital status, '
'email and postal addresses, phone numbers, '
'household composition, dependents, reference '
'tax income, withholding rates, company names, '
'SIREN numbers, cadastral data',
'identity_theft_risk': 'High'},
'investigation_status': 'Ongoing',
'motivation': 'Data Theft',
'recommendations': 'Taxpayers advised to use the secure portal for '
'communications and avoid sharing sensitive information '
'via phone, text, or email',
'references': [{'source': 'DGFiP Announcement'}],
'response': {'communication_strategy': 'Notifying affected parties via email '
'or post, warning about phishing scams '
'and fraudulent schemes'},
'threat_actor': 'ZeroBytes',
'title': 'French Tax Authority Data Breach Affecting 600,000 Taxpayers and '
'Businesses',
'type': 'Data Breach'}