Direction Générale des Finances Publiques

Profile narrative

The Direction Générale des Finances Publiques (DGFiP) is a French public finance and tax administration authority. Its core domain is the management of tax-related public functions and records concerning individuals, professionals, and businesses in France. The organisation’s systems handle sensitive fiscal information, including reference tax income, family quotient, and tax withholding rates. They also contain identifying details, company names, SIREN numbers, and cadastral data relating to real-estate addresses and surfaces. This combination of information shows that the DGFiP’s work spans personal taxation, business identifiers, and property-related records. As a government authority, it operates within France’s public sector rather than as a commercial service provider.

The clearest explicit measure of the organisation’s data footprint in the available material comes from a confirmed cyber incident affecting approximately 678,000 individuals and professionals. This figure describes the breach impact and should not be interpreted as the total size of the DGFiP’s taxpayer population. The incident involved unauthorised access through a VPN connection, with an attacker impersonating authorised users to reach internal consultation tools. The unauthorised access was terminated, although the data exfiltration was not detected at the time. No usernames or passwords were reported as compromised in the incident. The DGFiP notified the French data protection authority, CNIL, and announced that it would file a complaint. A prior unauthorised access to another government system had already prompted the authority to strengthen external-access controls. French authorities later arrested an 18-year-old suspected member of the ZeroBytes hacking group in connection with attacks targeting the DGFiP and other entities.

Incidents

2 incidents linked to this organisation.