French Data Breach Exposes 3 Million Phone Numbers from Defunct Bloctel Service A significant data breach has compromised three million telephone numbers from Bloctel, France’s former opt-out registry for unsolicited marketing calls. The incident, confirmed by the Direction générale de la concurrence, de la consommation et de la répression des fraudes (DGCCRF), occurred just before the service’s permanent closure on August 11, 2024, as France transitioned to a new opt-in system for telemarketing. The breach stemmed from a cybercriminal gaining unauthorized access to a professional account used by businesses to verify numbers against Bloctel’s opt-out list. While 600,000 of the exposed numbers were registered with Bloctel, the DGCCRF clarified that no additional personal data (such as names or addresses) was compromised, and the core Bloctel database remained secure. Affected individuals have been notified, and the compromised account was swiftly blocked. The DGCCRF conducted a review of all professional accounts to prevent further unauthorized access. The breach coincides with France’s shift to stricter telemarketing regulations, replacing the opt-out system with an opt-in model requiring explicit consumer consent for commercial calls. Exceptions remain for existing contracts and certain subscriptions. Consumers can now report unsolicited calls via SignalConso and request data deletion from companies.

French Tax Authority Confirms Data Breach Affecting 600,000 Taxpayers and Businesses France’s General Directorate of Public Finances (DGFiP) has revealed that a recent cyberattack exposed sensitive data belonging to approximately 600,000 individuals and businesses. The breach, first acknowledged last week, involved the theft of messages exchanged between the tax authority and around 250 taxpayers, along with personal and financial details of hundreds of thousands more. The compromised data includes tax identification numbers, marital status, email and postal addresses, phone numbers, household composition, dependents, reference tax income, and withholding rates. For roughly 250,000 businesses and professionals, the exposed information was limited to company names and SIREN numbers the unique nine-digit identifiers for French enterprises. Additionally, cadastral data, such as property addresses and dimensions, was accessed, though DGFiP noted this information was already publicly available. The attack was claimed by a cybercriminal known as "ZeroBytes," who initially alleged the theft of data belonging to over 2 million individuals a figure far exceeding the DGFiP’s confirmed count. The authority has not explained the discrepancy between its reported numbers and the attacker’s claims. DGFiP is notifying affected parties via email or post, warning that the stolen data could be used in phishing scams, impersonation attempts, and fraudulent schemes, including bogus bank adviser scams. The authority emphasized that it will never request sensitive information, such as PINs or identity documents, via phone, text, or email, directing taxpayers to use its secure portal for such communications. In a separate incident, DGFiP disclosed a "technical vulnerability" in the government’s Vacant Successions Portal (PSV), which helps locate estates without known heirs. The service was suspended after the flaw was discovered, though no evidence of data leakage has been found so far. The breach adds to a series of cybersecurity incidents plaguing France’s public sector this year. In February, the finance ministry reported a breach affecting 1.2 million citizens’ bank details. March saw the Health Ministry confirm the theft of 15.8 million administrative files including 165,000 containing doctors’ notes from healthtech firm Cegedim Santé. In April, a 15-year-old allegedly breached France Titres, the agency handling identity documents, claiming to have exposed data on up to 19 million people. June brought reports of an alleged breach of Tchap, the government’s encrypted messaging platform, with attackers claiming access to 73,000 user accounts and hundreds of thousands of messages.