French Tax Agency (DGFiP) Confirms Data Breach Affecting 678,000 Individuals and Professionals

DGFiP Confirms Major Data Breach

The Directorate General of Public Finance (DGFiP) in France has confirmed an intrusion that resulted in the leak of a file containing 678,000 entries. This breach affected both individuals and professionals, with sensitive financial information compromised.

Compromised Data Details

Amélie Verdier, Director General of Public Finance, confirmed that the leaked data includes names, family quotients, reference tax income, and withholding tax rates. An analysis of the data by FrenchBreaches also indicated that addresses, phone numbers, email addresses, and the number of dependents were exposed.

Attack Vector and Timeline

The attacker's access was reportedly cut in late June, but the data exfiltration was not detected at that time. The breach was only identified after the stolen data was put up for sale on August 12. The perpetrator claimed to have gained access through a VPN used by tax agents.

The same attacker also claimed a second breach in late July, targeting the professional server for cadastral data, affecting over two million people. This second incident was also confirmed by the administration.

Political Reaction and Broader Context

The incident has drawn political attention, with MEP Aurore Lalucq calling for the resignation of David Amiel, the minister responsible for public accounts. This breach follows a previous security incident involving the ANTS (National Agency for Secure Documents) and occurred around the same time as another hack targeting the National Education administration in late July.