As of this Monday, the 678,000 individuals and businesses whose data has been hacked on the impots.gouv.fr site will be informed by the General Directorate of Public Finances (DGFiP) of the damage they have suffered. The stolen data relates, for individuals, to their first and last names, the family quotient, the reference tax income and the withholding tax rate. The tax administration therefore ended up confirming this massive cyberattack which occurred in June. European regulations required that the leak be reported within 72 hours to the CNIL and subsequently to the victims. However, the information was only made public on Wednesday. 24 hours after it was claimed by a group of hackers. The DGFiP should have communicated in advance. For all explanation, she cites that she was unable to detect that the attack resulted in the theft of confidential data. Mind-boggling. Because it concedes both the flaw in its system but also the failure of its controls which, without the admission of the cybercriminals, would not have allowed it to measure the extent of the damage. Another option is that it had no plans to publicize this scandal, just to hide the vulnerability of its IT security.
Open investigation
Since the information was relayed, the tax unions have not taken off. Because they had alerted their management in June about the risk of “hacking, identity theft or targeted phishing”. In short, it’s not as if their management was not informed of a risk of sensitive data being hacked. In addition to shedding light on this extensive looting, the open investigation must target the perpetrators, calling themselves “ZeroBytes” and whose hunt includes, among others, the French Handball Federation and Intermarché. They claim, moreover, to have had access to a tax database of more than 2 million people and assure that they always want to resell the data that they managed to hack.
