French tax authority confirms theft of 2 million taxpayers' data
Cybercriminal advertises stolen data on dark web forums
1Attack details
France's General Directorate of Public Finances (DGFiP) confirmed that a cybercriminal breached their systems in June 2026 and stole data of 2 million taxpayers. The attacker, using the alias 'ZeroBytes', marketed the stolen database on a cybercrime forum. The breach allegedly involved stolen credentials and a multi-factor authentication (MFA) bypass technique to access sensitive taxpayer information.
2Official response
DGFiP denied ZeroBytes' claims of maintaining ongoing access but admitted that data was viewed and extracted following identity theft in late June. The agency implemented new restrictions to block access and launched an investigation to determine the number of affected users. They stated they would notify France's data protection authority CNIL about the incident.
3France's cybersecurity track record
This incident marks the latest in a series of cyberattacks targeting France's public sector. In February 2026, the Ministry of Finance acknowledged theft of 1.2 million citizens' banking details. Weeks later, the Health Ministry confirmed an attack on Cegedim Santé compromising 15.8 million administrative files. April saw an attack on France Titres, responsible for identity documents.
4Previous major breaches
The France Titres breach allegedly affected 18-19 million people (a quarter of France's population). In June, encrypted government messaging platform Tchap reported compromise of over 73,000 user accounts and leakage of 643,000 messages. These incidents reveal serious security vulnerabilities in France's critical infrastructure systems.
5Technical aspects of the attack
ZeroBytes claimed to use MFA bypass techniques, which are becoming increasingly common for circumventing security measures. The attacker's assertion of maintaining persistent access suggests significant network security flaws at DGFiP. Despite the agency cutting access during a June audit, data had already been extracted.
6Process for affected individuals
DGFiP is conducting in-depth investigations to determine exactly what data and how many users were impacted. Affected individual and professional taxpayers will be notified once identified. The agency will make mandatory reports to France's CNIL under GDPR regulations, which can impose severe penalties for such breaches.
7Security vulnerabilities in public institutions
These attacks demonstrate inadequate cybersecurity measures in French public institutions, particularly regarding protection of identity and financial data. With at least 37 million citizens' data compromised in public sector breaches during 2026 alone, the situation raises national security concerns requiring immediate attention.
8Long-term implications
These breaches erode public trust in government institutions. Stolen sensitive tax and identity data increases risks of identity theft and financial fraud. Public agencies urgently need to strengthen cybersecurity infrastructure and enhance staff training. Without these measures, similar attacks are likely to continue in the coming period.