The French Ministry of the Economy and Finance has disclosed a data breach after an attacker accessed the General Directorate of Public Finances (DGFiP) systems and stole data belonging to 678,000 individuals.
This incident was discovered after a threat actor using the “ZeroBytes” handle claimed the attack and listed a stolen database for sale on August 12 on the PwnForums hacking forum.
“The in-depth investigations conducted since August 12, 2026, have established that, prior to their interruption, these access points had been used to consult and extract data concerning a total of 678,000 individuals and professionals, including tax data such as reference tax income, family quotient, and withholding tax rate, and, for businesses, data such as their company name and SIREN number,” the French Ministry of Economy said.
“Cadastral data relating to addresses and property sizes were also accessed. As soon as these data breaches were identified, the French Public Finances Directorate (DGFIP) notified the French Data Protection Authority (CNIL). The online accounts of individual and professional users were not compromised. User IDs and passwords were not compromised.”
After detecting the attack, the French tax administration shut down access to sensitive information systems and continues investigating the incident with the help of the National Cybersecurity Agency of France (ANSSI) to assess the breach’s full impact.
In a post on the hacking forum, ZeroBytes also claimed they gained access to the Serveur Professionnel de Données Cadastrales (SPDC), an online platform operated by the French tax authority that provides access to the country’s central land registry and property ownership records.
While the portal gave them access to data on roughly 20 million French citizens, the threat actor claims they only managed to steal 252,149 records containing data on over 2 million people.
“We couldn’t finish the extraction because honestly, it’s just horrible to scrape and would have taken months. I’m still logged into the panel, so if you want, you can buy it along with the database,” they said. “I’m not going to sell this one for very much anyway. And as always, no mention from France about this incident.”
The DGFiP added on Friday that it will contact all affected individuals starting next week via email or letter, with details on what data may have been accessed or stolen and the necessary precautions to take.
This is just the latest in a spree of cyberattacks and data breaches that have impacted multiple French government agencies in recent months.
In January, the French data protection authority fined the national employment agency France Travail €5 million after hackers stole the personal information of 43 million people. One month later, the French Ministry of Finance disclosed another data breach affecting over 1.2 million user accounts after hackers stole a database from the national bank account registry (FICOBA) systems.
More recently, France Titres, the government agency in France for issuing and managing administrative documents, also disclosed a data breach after a threat actor put up for sale a database containing 19 million records allegedly stolen from the National Agency for Secure Documents (ANTS).
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
France fines unemployment agency €5 million over data breach
Valve notifies Steam hardware customers of a data breach
Canadian pleads guilty to Snowflake cloud data-theft attacks
Hugging Face warns an autonomous AI agent hacked its network
Lidl discloses online shop breach after service provider hack
Hackers arrested over €30M bank fraud exploiting service provider flaw
RingCentral data breach exposed info of 1.6 million accounts
Hackers exploit macOS Screen Sharing flaw to deploy Monero miner
Stop AI slopsquatting attacks. Secure open source package ingestion before it hits your build.
91% of AI Apps Appeared in 16 Months. Get Material’s OAuth Risk Report
Overdue a password health-check? Audit your Active Directory for free
Overdue a password health-check? Audit your Active Directory for free
Pixellot discovered and secured hundreds of unmanaged AI agent identities in weeks, not months. Download the case study for how.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
