Heat in Bercy after the tax hack. While nearly 700,000 individuals and professionals saw their tax data hacked, the Minister of Public Accounts, David Amiel, presented his “apologies” on Tuesday August 18. The tax administration also recognized another leak of data on inheritances – less sensitive, according to it.
“Yes, we apologize, because what happened is unbearable for the French,” declared the minister during a press conference in Bercy devoted to this historic cyberattack against the General Directorate of Public Finances (DGFiP).
In the process, the general director of the institution, Amélie Verdier, admitted the existence of an unprecedented computer breach concerning inheritance data, spotted on Monday and quickly “cut”. This flaw is “really not at all of the same magnitude” as the previous attacks, she however tempered. According to her, the information exposed turns out to be much less sensitive, akin to simple public “legal announcements”.
Also readTax hacking: victims begin to be contacted, an audit requested
On the communication front, David Amiel demanded that each taxpayer concerned about their data “be greeted with the greatest respect” by the tax services. A clarification following a controversy born Tuesday on X, where the screenshot of what is presented as the unkind response of a tax agent to a worried taxpayer went viral.
“Our information systems have weaknesses”, conceded the minister, who mentioned several phases of an action plan, including “the fight against the compromise of agents’ accounts” and a strengthening of “the cyber training of agents”. Noting that the explosion of AI capabilities increased threats tenfold, David Amiel also asked “that we test ourselves with artificial intelligence under control”.
“We were not aware of the data theft before August 12”
Amélie Verdier also worked to detail the chronology of the first attack, the most important. At the end of June, the hackers managed to steal access from an “external agent, deemed secure”, which they then used to break into “the access channels” to tax data.
Once infiltrated, the hackers “did extraction tests” manually, before initiating massive siphoning. All while remaining below the DGFiP alert thresholds, calibrated to allow agents to process a large volume of information daily.
By a technical means that the director refused to disclose, Bercy services ended up detecting the compromise of an account and cut off its access.
Also readHacking of banking data: France “very poor student” in terms of cybersecurity
“Investigations” are then carried out internally, but prove to be “unfortunately insufficient”, by Amélie Verdier’s own admission, since they completely miss the massive theft of data. It was ultimately only on August 12, the day the piracy was claimed on a specialized resale forum, that the DGFiP became aware of the extent of the leak.
“We were not aware of the data theft before August 12,” insisted Amélie Verdier. She thus firmly denies the accusations, particularly union accusations, accusing the tax authorities of having delayed in making the matter public.
The “ZeroBytes” hacker group also claims hacking of National Education
The theft concerns at least 678,000 individuals and professionals for tax data, to which must be added some 430,000 individuals targeted by the leak of cadastral files.
Seized of the file, the Paris prosecutor’s office opened an investigation, notably charging charges of “fraudulent extraction of data” and “criminal conspiracy”.
On Monday, the administration began a campaign to contact victims and make them aware of the risks of phishing and identity theft. For its part, the “ZeroBytes” pirate group, contacted the same day by AFP, claimed to have already sold the data to “two people” for several “thousands” of euros.
The affair now threatens to slide into the political arena, a few weeks before a tense social start and the resumption of budgetary discussions. Socialist senators called for the creation of a parliamentary commission of inquiry, pointing out the repetition of security flaws within the Ministry of the Economy.
ZeroBytes also claimed on a forum to have gotten its hands on the personal data of several million French students and tens of thousands of teachers. They claim to have telephone numbers, email addresses and home addresses in particular, sometimes dating back to the 2000s. A judicial investigation is underway, according to the Ministry of National Education.
With AFP
