France probes unprecedented cyberattack after tax data of 678,000 users stolen

 French prosecutors have opened an investigation into a major cyberattack on the country’s tax administration that affected nearly 700,000 individuals and businesses, authorities said on Saturday. 

 

 

The cybercrime unit of the Paris Public Prosecutor’s Office is investigating the fraudulent extraction of data from a state-operated personal information system, following an attack described by tax officials as more sophisticated than previous incidents.

The investigation has been entrusted to France’s Office for the Fight against Cybercrime, known as Ofac.

Prosecutors said the inquiry also covers suspected participation in a criminal conspiracy aimed at preparing an offence punishable by at least five years in prison.

The attack allowed hackers to extract data relating to 678,000 users of France’s tax system, including both private individuals and companies. 

 

 Tax authorities said the incident was more complex than cyberattacks they had faced in the past, potentially renewing concerns over the security of government information systems following a series of recent breaches involving other public bodies. 

 

 

Personal data exposed

For individual taxpayers, the information obtained included full names, family quotient details, reference taxable income and withholding tax rates, according to Amélie Verdier, Director-General of Public Finances.

However, the Directorate-General for Public Finances, or DGFiP, stressed that the stolen information does not provide access to taxpayers’ secure accounts on the impots.gouv.fr website.

Officials said those affected would be contacted from early next week, with particular emphasis on alerting them to the potential risk of identity theft and fraudulent attempts to obtain further personal information. 

 

 

For businesses, the information exposed was considered less sensitive, Verdier said.

It included details such as a company’s SIREN registration number, its business address and the address of its authorised representative.

The incident comes after a number of cyberattacks involving French public institutions in recent weeks, including systems linked to the National Agency for Secure Documents, known as ANTS, and national statistics agency INSEE.

The latest breach is likely to add to scrutiny of the measures used to protect state-held data, particularly as cybercriminals increasingly target public administrations and databases containing large quantities of personal information. 

 

https://www.rfi.fr/en/france/20260815-france-probes-unprecedented-cyberattack-after-tax-data-of-678-000-users-stolen