France probes unprecedented cyberattack after tax data of 678,000 users stolen

Investigation launched into tax data breach

French prosecutors have opened an investigation into a major cyberattack on the country's tax administration that affected nearly 700,000 individuals and businesses, authorities announced on Saturday. The cybercrime unit of the Paris Public Prosecutor’s Office is investigating the fraudulent extraction of data from a state-operated personal information system, following an attack described by tax officials as more sophisticated than previous incidents.

The investigation has been entrusted to France’s Office for the Fight against Cybercrime, known as Ofac. Prosecutors said the inquiry also covers suspected participation in a criminal conspiracy aimed at preparing an offence punishable by at least five years in prison.

The attack allowed hackers to extract data relating to 678,000 users of France’s tax system, including both private individuals and companies. For individual taxpayers, the information obtained included full names, family quotient details, reference taxable income and withholding tax rates, according to Amélie Verdier, Director-General of Public Finances. However, the Directorate-General for Public Finances, or DGFiP, stressed that the stolen information does not provide access to taxpayers’ secure accounts on the impots.gouv.fr website.

Officials said those affected would be contacted from early next week, with particular emphasis on alerting them to the potential risk of identity theft and fraudulent attempts to obtain further personal information. For businesses, the information exposed was considered less sensitive, Verdier said, including SIREN registration numbers, business addresses, and addresses of authorised representatives.

Two separate attacks on tax agency computers

According to France 24, French authorities admitted on August 14 that cyber hackers had stolen detailed financial information on hundreds of thousands of individuals and companies from tax and land registry computers. The DGFiP said there were two separate cyber attacks on its computers. Details from more than 678,000 individual and professional accounts were taken in the first hack in June, with names, "income reference data" and tax rates paid among the details taken. The second theft in July concerned details on 200,000 land registry accounts.

The agency's head, Amélie Verdier, said on Tuesday that another data breach was detected on Monday and is still being evaluated.

The attack has prompted a swift response from the government. Public Accounts Minister David Amiel asked the DGFiP to begin informing affected taxpayers as early as Monday and requested proposals on strengthening security procedures. The investigation will seek to establish how attackers gained access, who was behind the operation, and whether stolen information has been shared or used elsewhere.

Hacking group claims responsibility

The thefts were claimed on a dark-web forum by ZeroBytes, a self-proclaimed French hacking duo who said they had access to a VPN used by tax officials. Contacted by AFP and asked about motives, the duo said they had no "particular motivation" before adding: "money, I imagine". They said the stolen information had already been sold to "two people" for "thousands of euros".

The duo claim to have details on 250,000 land registry accounts involving about 2 million people who own land and property in France. On Monday, the group said they also obtained information on millions of students and tens of thousands of teachers, some dating back 20 years.

Government response and broader context

Prime Minister Sébastien Lecornu on Wednesday asked the National Cybersecurity Agency to set up a new "cyber unit" to counter cyberattacks. Budget Minister David Amiel said his ministry will use AI tools to test cybersecurity vulnerabilities of government agencies, working only with "sovereign" AI providers such as Mistral, explicitly excluding US-based OpenAI.

The incident is part of a series of cyberattacks on French public institutions in recent months. France's ANTS was hit by a massive attack in April affecting nearly 12 million individuals and professionals. In February, a large-scale breach of the finance ministry's computer system resulted in theft of details of 1.2 million bank accounts. Days later, hackers stole medical information of some 15 million individuals.

Experts say France is one of the countries most targeted by cybercriminals.