France's National Tax Authority Investigates June Data Breach
The DGFiP confirmed an intruder accessed taxpayer files via a compromised VPN identity, following a pattern of state-level security failures.
France's Directorate General of Public Finances (DGFiP) is investigating a security breach after an unauthorized actor accessed the national tax authority's information systems. The incident, which occurred in late June, underscores the persistent vulnerability of government infrastructure to identity-based attacks.
According to the DGFiP, the attacker gained entry by stealing or misusing a legitimate identity to connect to the agency's Virtual Private Network (VPN). Once inside the system, the intruder was able to view and extract fiscal files belonging to both individuals and businesses. The agency stated that the breach was detected and terminated within the same month of June. The incident became public after a hacker using the alias 'ZeroBytes' claimed responsibility for the attack, asserting that they stole approximately 678,438 lines of taxpayer data.
A Pattern of State Vulnerability
This breach is the latest in a series of high-profile cyberattacks targeting French government agencies. In February 2026, the National Bank Accounts File (FICOBA) suffered a breach that affected 1.2 million accounts. This was followed in April 2026 by a security failure at the National Agency for Secure Documents (ANTS), further demonstrating a trend of successful intrusions into critical state databases over the last several months.
Implications for Taxpayers
The compromise of a national tax authority is particularly severe due to the nature of the data stored. Tax records typically contain a combination of financial history and personal identification markers, which are highly prized by cybercriminals. The extraction of these files significantly increases the risk of targeted fraud, phishing campaigns, and identity theft for the hundreds of thousands of citizens and businesses potentially impacted by the ZeroBytes leak.
Next Steps
The French Economy Ministry has launched a formal investigation into the breach to determine the full scope of the data exfiltration. While the DGFiP has cut off the intruder's access, officials are now working to verify exactly which records were compromised. It remains to be seen whether the government will provide direct notification to the 678,000 individuals claimed by the attacker or if the investigation will reveal a different number of victims.