French Tax Data Stolen Using Staff Passwords, Undetected for Seven Weeks

Data Theft Details

An attacker accessed and copied tax data belonging to hundreds of thousands of French taxpayers and businesses between June and July. The data was taken from E-Contact, a tool used by taxpayers to communicate with the tax administration (DGFIP). The DGFIP confirmed that data for over 350,000 individuals and 250,000 businesses was affected.

For individuals, the stolen data included tax ID, contact details, family situation, taxable income, tax withholding rate, and a list of messages exchanged with DGFIP. For a smaller number of individuals (fewer than 250), the content of messages may also have been compromised. For businesses, the data included company name, SIREN registration number, address, and basic message details, with message content potentially exposed for fewer than 2,076 businesses. Taxpayers' personal online accounts and passwords were not directly compromised.

Detection Failure and Initial Response

The data theft went undetected by both the DGFIP and France's national cybersecurity agency (ANSSI) for seven weeks. The breach became public on August 12 when the attacker claimed responsibility on an online forum. This prompted Prime Minister Sébastien Lecornu to request an in-depth audit from ANSSI.

Initially, the ministry overseeing the DGFIP stated that the theft was not detected due to the "sophistication of the attack." However, ANSSI's subsequent report contradicted this, describing the attack as unsophisticated and attributing its success to weak login protection, poorly separated networks, and monitoring deficiencies.

Attack Vector

According to the ANSSI report, the attacker used two separate routes to gain access. The primary method involved using several dozen DGFIP staff passwords that were stolen over a three-month period, likely via infostealer malware on unmanaged devices, such as personal computers of staff members.

The attacker exploited two portals, PIGP and ADER, which only required a password for access. PIGP is a web portal for DGFIP staff email and HR services, while ADER provides access to certain DGFIP applications via the RIE, the network connecting French government ministries.