Cyber Incident Victim: Direction Générale des Finances Publiques
Timeline
Summary
Hackers accessed the French tax authority's systems and stole financial data from hundreds of thousands of individual and business accounts, including income details and tax rates, as well as land registry information. The attackers, a self‑proclaimed hacking duo, claimed to have sold the data for thousands of euros and also said they obtained additional records on landowners, students and teachers, prompting the government to announce new cybersecurity measures.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 0 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In June 2026, hackers breached the computers of France's Public Finance agency (DGFiP) and exfiltrated data from more than 678,000 individual and professional accounts, including names, income reference data and the tax rates paid. A second breach occurred in July 2026, during which details from approximately 200,000 land registry accounts were taken. French authorities publicly acknowledged the two attacks on August 14, 2026, confirming that the stolen information originated from tax and land registry systems. On the Monday preceding the public disclosure, DGFiP head Amélie Verdier reported that another potential data breach had been detected and was still under evaluation.
The intrusions were claimed on a dark‑web forum by a self‑proclaimed French hacking duo called ZeroBytes, who stated they had gained access through a virtual private network used by tax officials. When questioned by AFP about their motives, the duo said they had no particular motivation before adding that money was likely a factor, and they asserted that the stolen data had already been sold to two individuals for thousands of euros. ZeroBytes further claimed to possess details on about 250,000 land registry accounts, which they said correspond to roughly two million property owners in France. The group also asserted on the same Monday that they had obtained information on millions of students and tens of thousands of teachers, some of the records dating back twenty years.
Observers noted that France ranks among the countries most frequently targeted by cybercriminals, prompting Prime Minister Sébastien Lecornu to request that the National Cybersecurity Agency establish a dedicated cyber unit to defend against future attacks. In response to the revelations, Budget Minister David Amiel announced that his ministry would employ artificial intelligence tools to scan government networks for vulnerabilities. The government said these steps were being taken after the disclosure of the breaches.