A “malicious actor” hacked the tax authorities at the end of June, almost 680,000 people would be affected
The tax information system was the victim of “illegitimate access” at the end of June, allowing “the consultation and extraction of data concerning individuals and professionals”, Bercy announced Thursday August 13 in a press release, without specifying the nature of the data or the number of taxpayers concerned.
“On Wednesday, a malicious actor claimed illegitimate access to the information system of the General Directorate of Public Finances (DGFiP), which occurred at the end of June 2026, after identity theft,” explains Bercy.
“The first investigations confirm that this access, which was cut off at the end of June as part of the control carried out, nevertheless allowed the consultation and extraction of data concerning individuals and professionals,” adds the press release.
Also readHacking of banking data: France “very poor student” in terms of cybersecurity
Data put up for sale?
No order of magnitude of the number of victims is specified. The specialized site French Breaches, which documents cyberattacks committed in France, however reported Thursday morning on its site that 678,437 people would be affected, including 392,867 individuals and 285,570 professionals, and on X that “the file would now be on sale for several thousand euros”.
According to the Bercy press release, “the users concerned will receive individual information specifying the data likely to have been consulted or extracted and, where applicable, the vigilance measures to be adopted”.
Another leak would affect two million people
In addition, “a new leak linked to the DGFiP”, this time concerning “nearly two million owners of real estate and land in France, has been claimed”, a French Breaches manager told AFP on Thursday evening.
“The hacker claims to have names, dates of birth, addresses, land identifiers, cadastral plots and information on property held”, and to have “always access to the DGFiP account”, according to French Breaches, whose site was temporarily down.
See alsoOnline scams: our personal data used against us
Bercy, for its part, stressed that following the June attack, “the DGFiP immediately implemented new restrictive measures to put an end to it and prevent new illegitimate access”, without alluding to this possible new leak, and “in-depth investigations are continuing in order to precisely determine the data and the number of users concerned”.
“The DGFiP teams in charge of information systems are fully mobilized, in conjunction with the services of the economic and financial ministries, in particular the Service of the Senior Defense and Security Official (SHFDS), as well as with the National Agency for Information Systems Security (Anssi),” assures the text.
Finally, as is systematically the case in this type of hacking, the DGFiP “will notify the incident to the National Commission for Information Technology and Liberties (Cnil), file a complaint and communicate new elements as the investigations progress”.
With AFP
