Digital. Cyberattack against the tax authorities: commissions of inquiry and complaints in preparation

France strainer. On social networks, the expression is declined endlessly by Senator Nathalie Goulet (Orne, UDI), who has been calling since the spring for a commission of inquiry into cyberattacks and data leaks, the latest having affected nearly 700,000 tax users.

“The state of affairs is terrifying. At one point, it’s no longer a coincidence, and that no one talks to me about the Russians or whatever: it’s incompetence, because it’s 14 year old kids who hack these sites. We need to take stock of the responsibilities, and above all what should be put in place to prevent this,” laments the Norman elected official, who warns in particular against the risks of identity theft permitted by these leaks. “All-digital has brought a lot of ease to everyone’s daily life, but all-digital hacked is going to be hell on Earth. »

Towards compensation actions?

Supported by the president of the centrist Union group, Senator Hervé Marseille, the initiative could succeed as early as October according to Nathalie Goulet. This is because the subject has now become hot – in addition to being possibly radioactive for the government. The socialist senators sent a letter on Saturday to the President of the Senate, Gérard Larcher, to demand a parliamentary commission of inquiry, noting a succession of incidents which does not allow “at this stage to conclude a structural failure” but encourages verification of the existence of “common vulnerabilities”. This commission could “formulate the necessary legislative, regulatory, organizational and budgetary proposals”, suggests Patrick Kanner, the leader of the socialist group in the Senate.

Presidential candidate, Bruno Retailleau (LR) also seized on the controversy, to demand from X a “Vauban plan to build a real digital fortress and finally protect the data of the French”.

Actions before administrative justice are also in preparation. Registered with the Béziers bar, lawyer Jérémy Roche is preparing to launch collective actions against the DGFiP and France Titles. Since the State cannot be fined, it is in the area of ​​compensation that the lawyer, specialized in digital law and data protection, intends to place himself: “Article 32 of the GDPR requires the implementation of state-of-the-art security measures. This is clearly not the case: most attacks are unsophisticated,” believes the lawyer. The damage remains to be determined: “There are people for whom it will be obvious, those who were the subject of leaks linked to cryptos, gold sales or the shooting federation, who were robbed or forced to move. But for others, it can be moral harm.”