Breaches · 51 days ago
France’s DGFiP said attackers stole data on 678,000 people after getting into its systems with compromised employee and third-party credentials, plus an MFA bypass. The intrusion came to light after the actor calling itself ZeroBytes posted about the breach and offered the data for sale.
The access path mattered more than the account names. Because the logins looked legitimate and the second-factor check was bypassed, DGFiP’s initial suspension of the obvious accounts did not reveal the theft or end the exposure; the attackers could still read and extract tax and cadastral data while the access blended in with normal use.
For public-sector systems that trust staff, contractors, or other outside identities to reach sensitive records, this is a trust-path failure, not a simple stolen-password event. If those identities can open high-value portals, disabling one account after the fact may leave the real pivot — the identity path into the records — untouched.
4 sources covering this story
French tax authority says break-in exposed data of 600K, including some private messages
Stolen details range from contact information to household finances and withholding rates
France’s tax authority admits hackers made off with data on 678,000 individuals - Help Net Security
France’s tax authority says a data breach exposed tax and business information belonging to 678,000 people and professionals.
680,000 Impacted by French Tax Authority Data Breach
Hackers used compromised credentials to access enterprise and personal tax-related data.
The Record from Recorded Future
France investigates tax authority breach after hacker claims 600,000 victims
French authorities confirmed that someone gained unauthorized access to systems at the Directorate General of Public Finances in late June after stealing or misusing someone’s identity.
Part of the PlainSec briefing for 2026-08-18