French Tax Authority Investigates Data Breach After Hacker Claims 600,000 Victims

Breach Confirmation and Details

France’s tax authority, the Directorate General of Public Finances (DGFiP), confirmed that its information systems were breached in late June. The Economy Ministry stated that an attacker gained unauthorized access to DGFiP systems after stealing or misusing someone’s identity. This intrusion allowed the attacker to view and extract data belonging to individuals and businesses.

Hacker's Claims and Unverified Data

The incident became public after a hacker, identified by FrenchBreaches as 'ZeroBytes', claimed responsibility earlier this week. The hacker alleged to have obtained data on more than 600,000 people, including names, personal information, tax identification numbers, email addresses, family circumstances, and tax status details. These claims and the authenticity of the data have not been independently verified by the DGFiP.

Investigation and Response

The unauthorized access was detected and cut off in late June. Authorities are now working to determine the precise information accessed or stolen and the exact number of affected individuals and businesses. The DGFiP plans to contact individuals whose data was compromised, notify France’s data protection authority, and file a criminal complaint as the investigation progresses.

Method of Attack

According to FrenchBreaches, the hacker claimed they gained access to internal servers, which enabled them to connect to the agency’s VPN and use an internal tool to search for information. The attacker stated they began stealing data before their access was terminated.

Context of Recent French Government Breaches

This incident is one of several breaches affecting French government agencies this year. In April, the website of France’s National Agency for Secure Documents (ANTS) was targeted, and the Education Ministry also disclosed a breach in the same month.