French Tax Authority Confirms Data Breach Affecting 678,000 Individuals and Businesses France’s General Directorate of Public Finances (DGFiP) has disclosed a data breach after an attacker accessed its systems, exposing sensitive information on 678,000 individuals and professionals. The incident was first revealed when a threat actor using the alias ZeroBytes claimed responsibility on a cybercrime forum, offering a stolen database for sale. According to ZeroBytes, the compromised portal contained data on approximately 20 million French citizens, though only 252,149 records covering over 2 million people were successfully extracted. The attacker cited difficulties in scraping the full dataset, stating the process would have taken months. They claimed to have gained access using stolen login credentials and an MFA bypass technique, though they remained logged into the system at the time of their post. The DGFiP confirmed the breach, stating that while access was immediately suspended upon detection, initial investigations did not reveal data theft due to the attack’s sophistication. Further analysis, conducted since August 12, 2026, determined that the attacker accessed and extracted tax-related data, including reference tax income, family quotient, withholding tax rates for individuals, and company names and SIREN numbers for businesses. The agency clarified that online tax portals for individuals and businesses were not compromised, nor were user credentials. The DGFiP has notified France’s data protection authority (CNIL) and implemented additional security measures, including temporary shutdowns of sensitive systems. The finance ministry’s security office (SHFDS) and the national cybersecurity agency (ANSSI) are assisting in the response. This breach follows a series of recent cybersecurity incidents targeting French government agencies.