France’s Tax Authority Confirms Breach and Data Extraction
Summary
France’s DGFiP says an attacker used stolen or misused credentials to access its systems and extract data in late June. Authorities are investigating the scope; ZeroBytes’ claim of more than 600,000 victims remains unverified.
Key points
- France’s Economy Ministry said an attacker accessed DGFiP systems in late June after stealing or misusing someone’s identity.
- The unauthorized access allowed the attacker to view and extract data belonging to individuals and businesses; officials detected and cut off access in late June.
- The attacker later claimed responsibility using the alias ZeroBytes, but the DGFiP has not publicly attributed the breach to a specific threat actor.
- FrenchBreaches reported that ZeroBytes claimed to have data on more than 600,000 people; the claim and the authenticity of the purported data have not been independently verified.
- Authorities are investigating what information was accessed and how many people and businesses were affected; the DGFiP says affected individuals will be contacted.
- The agency said it would notify France’s data protection authority and file a criminal complaint.
Article Details
- Victim Organization
- Directorate General of Public Finances (DGFiP)
- Incident Type
- Unauthorized access using stolen or misused identity credentials, followed by viewing and extraction of data.
- Data Types Exposed
- Data belonging to individuals and businesses was confirmed as viewed and extracted; specific data types were claimed by ZeroBytes but have not been independently verified.
- Names and other personal information (claimed; unverified)
- Tax identification numbers (claimed; unverified)
- Email addresses (claimed; unverified)
- Family circumstances (claimed; unverified)
- Tax status details (claimed; unverified)
- Affected Records
- ZeroBytes claimed data on more than 600,000 people; the claim has not been independently verified, and authorities are investigating the number affected.
- Operational Impact
- Unauthorized access was detected and cut off in late June. The tax authority imposed additional restrictions to prevent further unauthorized access and is investigating the scope of the incident and notifying affected people.
- Claim Status
- confirmed