A malicious actor gained unauthorized access to the information system of the Directorate General of Public Finances (DGFiP) in late June 2026, following identity theft. The unauthorized access allowed the intruder to consult and extract data concerning individuals and professionals.
The breach was detected and access was cut off during an internal audit in late June. The French Ministry of Economy and Finance (Bercy) confirmed the cyberattack on Thursday, 13 August, and a malicious actor claimed responsibility for the breach on Wednesday, 12 August 2026.
The compromised data may include names, birth dates, postal addresses, phone numbers, email addresses, tax identification numbers, withholding tax rates, records of correspondence with tax officials, and business SIREN numbers. No usernames or passwords were compromised.
Potential number of people affected, including 392,867 individuals and 285,570 professionals, according to the specialized site French Breaches.
The French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), will be notified of the incident, and the DGFiP will file a police report. Affected users will receive individual notifications specifying which data may have been accessed or extracted, along with advice on precautionary measures.
The DGFiP is conducting investigations in coordination with the Haut fonctionnaire de défense et de sécurité (SHFDS) and the Agence nationale de la sécurité des systèmes d'information (ANSSI). The agency has also implemented new restriction measures to prevent further unauthorized access.
The breach reportedly occurred via a compromised internal virtual private network (VPN) that allowed access to a taxpayer search tool. A separate potential data leak involving nearly two million property owners in France has been claimed by the same actor, though Bercy did not confirm this second leak in its official statement.
French Breaches also reported that the stolen data file is being sold for several thousand euros, and that the pirate claims to still have access to the DGFiP account. The DGFiP has said it will communicate new information as the investigation progresses.
