French Tax Data Breach Exploited Weak Internal Security for Seven Weeks
Attackers accessed sensitive taxpayer data through stolen staff credentials and unmonitored portals.
1Massive data exposure
Attackers compromised over 350,000 individual and 250,000 business tax records through France's DGFIP tax administration systems. The breach exposed sensitive information including tax IDs, contact details, family situations, and message histories with tax authorities. For businesses, company names, SIREN registration numbers, and correspondence details were accessed. The attack remained undetected for seven weeks until the hacker publicly claimed responsibility on August 12.
2Two attack vectors exploited
The breach occurred through two separate pathways. The primary route used dozens of stolen DGFIP staff passwords over three months, likely obtained via infostealer malware on personal devices. Attackers accessed poorly secured portals (PIGP and ADER) that only required passwords. The secondary route compromised a land surveyor's credentials to bypass two-factor authentication on the APEX partner portal, accessing nearly 435,000 property records between July 27 and August 8.
3Critical security failures
ANSSI's report highlights multiple systemic failures: no separation between sensitive and non-sensitive systems on the government network (RIE), lack of monitoring on critical portals (ADER), and no correlation of suspicious signals like nighttime logins or VPN connections from India. The security operations center (SOC) missed multiple red flags, including automated data scraping that extracted 11GB over three days in June. Basic protections like request rate limiting were absent.
4Detection and response gaps
Despite detecting some compromised accounts, the SOC failed to connect the dots. On June 23, they reset a suspicious account's password 14 hours after alert generation, but didn't terminate the active ADER session, allowing 16 more hours of data exfiltration. In July, they again missed ongoing extraction attempts. ANSSI's own monitoring was ineffective as it only covered network entry/exit points without application-level visibility.
5Cross-government vulnerabilities
The attacker initially breached the Education Ministry's systems before pivoting to tax data via the shared RIE network. Although the Education Ministry shared 17 compromise indicators on June 9, the warning came too late. The attack revealed fundamental weaknesses in inter-ministerial security coordination and threat intelligence sharing, with critical delays in analyzing and acting on compromise indicators.
6Immediate containment measures
Following discovery, DGFIP permanently closed staff access to ADER and PIGP portals, disabled the compromised surveyor's account, and locked APEX. These actions significantly disrupted tax services and partner operations. ANSSI provided two suspicious IP addresses from historical data on August 6, leading to five account resets, but the full breach wasn't identified until the hacker's August 12 announcement.
7Planned security upgrades
DGFIP's action plan includes implementing strong authentication, extending monitoring to all business applications, and setting data access limits. E-Contact will add two-factor authentication and deploy tools to detect unusual data access patterns. Staff can no longer access DGFIP systems from personal devices. A comprehensive audit is planned to identify all potential vulnerabilities in the tax administration's infrastructure.
8Broader implications
This breach exemplifies how basic security failures can enable significant data theft despite existing protocols. The seven-week undetected access period demonstrates critical gaps in government cybersecurity monitoring. The incident has prompted urgent reviews of authentication practices, network segmentation, and threat detection capabilities across French government systems, with potential implications for other nations' tax administration security frameworks.