French Tax Authority Cyberattack Exposes Tax Data of 678,000 Individuals and Businesses

France’s Directorate General of Public Finances (DGFiP) has reported a cyberattack that resulted in unauthorized access to and extraction of tax and cadastral data for approximately 678,000 individuals and professional entities.

According to a press release from the French Ministry of Economy and Finance, issued on August 14, 2026, the intrusions occurred during June and July when a malicious actor impersonated the credentials of a DGFiP employee and an authorized third party. This activity was publicly acknowledged on August 12 and 13.

French Tax Authority Cyberattack

DGFiP stated that it suspended access to all accounts involved as soon as the suspicious intrusions were detected. Initial access-control reviews did not find evidence of data theft, given the sophistication of the attack.

However, an investigation that began on August 12 revealed that the compromised access points had been used to view and extract sensitive information before they were disabled.

Authorities are currently assessing the precise nature, quantity, and scope of the data that was removed from the systems.

This incident highlights the risks associated with identity-based attacks in public-sector environments. Rather than exploiting a publicly known software vulnerability, the attacker gained access by impersonating legitimate credentials associated with both an internal DGFiP agent and an authorized external party.

Tax and Property Data Accessed

The exposed records include information belonging to both private individuals and businesses. For individuals, the accessed information may include:

• Reference tax income
• Family quotient information
• Withholding tax rates

For professional entities, the compromised data may include company names and SIREN numbers, which are France’s business identification numbers. The attacker also accessed cadastral information, including addresses and property size details.

DGFiP emphasized that citizens’ and businesses’ online accounts were not compromised and that user IDs and passwords were not exposed, reducing the immediate risk of direct account takeover from this incident.

However, the combination of tax, identity, business, and property information could still facilitate targeted phishing, social-engineering attempts, or fraud campaigns.

Malicious actors could leverage details such as income data, business identifiers, and property information to make fraudulent communications appear credible.

Following the confirmation of the breach, DGFiP notified France’s data protection authority, the Commission Nationale de l’Informatique et des Libertés (CNIL).

They have also implemented additional security measures, including preventive shutdowns that affect access to sensitive information systems.

DGFiP’s information system teams are collaborating with the Ministry of Economy and Finance, the High Official for Defense and Security service, and France’s national cybersecurity agency, ANSSI.

Starting the following week, DGFiP plans to contact affected individuals and professionals directly via email or post. The notifications will detail the data that may have been accessed or extracted and will provide precautionary guidance where appropriate. Additionally, DGFiP will file a criminal complaint and has committed to releasing further details as the investigation progresses.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world