# French tax authority confirms theft of 2 million taxpayers' data Cybercriminal advertises stolen data on dark web forums - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-08-14 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/36d1785e-ac15-4c22-a770-195f6f161bd5 ## Attack details France's General Directorate of Public Finances (DGFiP) confirmed that a cybercriminal breached their systems in June 2026 and stole data of 2 million taxpayers. The attacker, using the alias 'ZeroBytes', marketed the stolen database on a cybercrime forum. The breach allegedly involved stolen credentials and a multi-factor authentication (MFA) bypass technique to access sensitive taxpayer information. ## Official response DGFiP denied ZeroBytes' claims of maintaining ongoing access but admitted that data was viewed and extracted following identity theft in late June. The agency implemented new restrictions to block access and launched an investigation to determine the number of affected users. They stated they would notify France's data protection authority CNIL about the incident. ## France's cybersecurity track record This incident marks the latest in a series of cyberattacks targeting France's public sector. In February 2026, the Ministry of Finance acknowledged theft of 1.2 million citizens' banking details. Weeks later, the Health Ministry confirmed an attack on Cegedim Santé compromising 15.8 million administrative files. April saw an attack on France Titres, responsible for identity documents. ## Previous major breaches The France Titres breach allegedly affected 18-19 million people (a quarter of France's population). In June, encrypted government messaging platform Tchap reported compromise of over 73,000 user accounts and leakage of 643,000 messages. These incidents reveal serious security vulnerabilities in France's critical infrastructure systems. ## Technical aspects of the attack ZeroBytes claimed to use MFA bypass techniques, which are becoming increasingly common for circumventing security measures. The attacker's assertion of maintaining persistent access suggests significant network security flaws at DGFiP. Despite the agency cutting access during a June audit, data had already been extracted. ## Process for affected individuals DGFiP is conducting in-depth investigations to determine exactly what data and how many users were impacted. Affected individual and professional taxpayers will be notified once identified. The agency will make mandatory reports to France's CNIL under GDPR regulations, which can impose severe penalties for such breaches. ## Security vulnerabilities in public institutions These attacks demonstrate inadequate cybersecurity measures in French public institutions, particularly regarding protection of identity and financial data. With at least 37 million citizens' data compromised in public sector breaches during 2026 alone, the situation raises national security concerns requiring immediate attention. ## Long-term implications These breaches erode public trust in government institutions. Stolen sensitive tax and identity data increases risks of identity theft and financial fraud. Public agencies urgently need to strengthen cybersecurity infrastructure and enhance staff training. Without these measures, similar attacks are likely to continue in the coming period. ## Sources covering this story - https://www.theregister.com/security/2026/08/14/french-tax-authority-admits-data-heist-after-crook-touts-2m-records/5287885 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._