France’s Directorate General of Public Finances (DGFiP) confirmed a cyber‑attack that compromised the personal, cadastral and inheritance records of a large number of taxpayers. The breach, disclosed in early August, is estimated to affect between 600,000 and 1.2 million individuals and businesses, according to various sources.
Scope of the breach
According to SecurityWeek, the intrusion impacted at least 1.2 million people, while French‑language outlets Le Monde and gbhackers.com cite figures of roughly 678,000 records and “over 600,000 users” respectively. The data exposed includes names, addresses, dates of birth, tax identification numbers, income details, property holdings and information on inheritances (successions).
The government has identified three distinct data sets that were leaked: standard tax filings, cadastral (land‑registry) information and succession files. The overlap of these datasets means that a single compromised record can reveal both financial and property ownership details, raising concerns about identity theft and fraud.
"The French tax authority confirmed that personal, cadastral and inheritance data of more than one million taxpayers have been compromised," the ministry said in a press release.
Government response and warnings
Within hours of the discovery, the DGFiP sent alerts to all registered taxpayers, urging them to monitor their accounts for suspicious activity. French public broadcaster RFI reported that officials warned citizens that the stolen data was already being offered for sale on underground forums, with prices ranging from a few hundred to several thousand euros per record.
Law‑enforcement agencies have opened investigations into the illicit marketplace. Several outlets, including Harici and The Cyber Express, quoted hackers who claimed they were selling the data to interested parties. The same actors are also alleged to have targeted the French education ministry, according to Brussels Signal, suggesting a broader campaign against public institutions.
In response, the French government announced a series of measures to harden its digital infrastructure. The Centre national de la cybersécurité (ANSSI) will employ artificial‑intelligence tools to test the resilience of critical systems, a step highlighted by CNA. Additionally, the ministry plans to contract domestic AI firms, such as Mistral, to develop bespoke security solutions, as reported by The Star.
Broader cyber‑threat landscape
The tax breach forms part of what Cyber Daily described as an unprecedented wave of cyber attacks across France, with one hacker group allegedly linked to multiple incidents, including a separate compromise of a popular WordPress form‑plugin that exposed 300,000 sites (SecurityWeek).
International observers note that the timing coincides with heightened scrutiny of AI safety after the Hugging Face breach, prompting firms like OpenAI to tighten safeguards (Bloomberg). While unrelated to the French tax hack, the developments underscore a global push to bolster cyber defenses.
French officials emphasized that restoring public confidence is paramount. As Le Monde put it, safeguarding taxpayers’ trust is essential for the functioning of the tax system. The DGFiP has pledged to provide free identity‑theft monitoring services to affected individuals and to accelerate the rollout of more robust authentication mechanisms for online tax filing.
The incident highlights the vulnerability of centralized public‑service databases and raises questions about the balance between digital convenience and data security. As investigations continue, French authorities warn that the full extent of the breach may take weeks to assess, urging citizens to stay vigilant and report any anomalies to the dedicated hotline established by the DGFiP.
