France probes unprecedented cyberattack after tax data of 678,000 users stolen
French prosecutors have opened an investigation into a major cyberattack
on the country’s tax administration that affected nearly 700,000
individuals and businesses, authorities said on Saturday.
The cybercrime unit of the Paris Public Prosecutor’s Office is
investigating the fraudulent extraction of data from a state-operated
personal information system, following an attack described by tax
officials as more sophisticated than previous incidents.
The investigation has been entrusted to France’s Office for the Fight against Cybercrime, known as Ofac.
Prosecutors
said the inquiry also covers suspected participation in a criminal
conspiracy aimed at preparing an offence punishable by at least five
years in prison.
The attack allowed hackers to extract data
relating to 678,000 users of France’s tax system, including both private
individuals and companies.
Tax authorities said the incident was more complex than cyberattacks
they had faced in the past, potentially renewing concerns over the
security of government information systems following a series of recent breaches involving other public bodies.
Personal data exposed
For individual taxpayers, the
information obtained included full names, family quotient details,
reference taxable income and withholding tax rates, according to Amélie
Verdier, Director-General of Public Finances.
However, the Directorate-General for Public Finances, or DGFiP, stressed that the stolen information does not provide access to taxpayers’ secure accounts on the impots.gouv.fr website.
Officials
said those affected would be contacted from early next week, with
particular emphasis on alerting them to the potential risk of identity
theft and fraudulent attempts to obtain further personal information.
For businesses, the information exposed was considered less sensitive, Verdier said.
It included details such as a company’s SIREN registration number, its business address and the address of its authorised representative.
The
incident comes after a number of cyberattacks involving French public
institutions in recent weeks, including systems linked to the National
Agency for Secure Documents, known as ANTS, and national statistics agency INSEE.
The
latest breach is likely to add to scrutiny of the measures used to
protect state-held data, particularly as cybercriminals increasingly
target public administrations and databases containing large quantities
of personal information.
