DGFiP cyberattack triggers calls for electronic invoicing reform moratorium

DGFiP cyberattack electronic invoicing reform data breach French tax administration SDI moratorium

The French Directorate General of Public Finances (DGFiP) confirmed two cyber intrusions in late June and late July, resulting in the unauthorized access or extraction of data belonging to at least 678,000 individuals and professionals. The compromised information includes names, birth dates, and for businesses, company names and SIREN numbers. While health-related data was involved, officials stated it was encrypted and remains unexploitable. Public Finance Minister David Amiel assured that no tax payments or tax assessment notices were affected by the breach.

In response to the breach, several hundred victims are organizing a class-action lawsuit against the state to seek damages for moral prejudice. Simultaneously, the Syndicat des Indépendants et des TPE (SDI) has called for a moratorium on the upcoming electronic invoicing reform, which is scheduled to begin on September 1, 2026. The SDI is demanding an independent security audit of the platforms before proceeding, citing concerns over the government's ability to protect the massive amounts of transaction data that businesses will soon be required to transmit.

The electronic invoicing reform requires all VAT-registered companies to be able to receive electronic invoices by September 2026, with small businesses having until September 2027 to comply with issuance requirements. Failure to comply can result in annual fines of up to €15,000 per company.

Entities

ANSSI · CSDD · David Amiel · Direction Générale des Finances Publiques · Elviss Strazdiņš · France · French Ministry of National Education · Syndicat des Indépendants et des TPE · Sébastien Lecornu

Claims

What the coverage asserts, and how many sources carry each claim.

[○ 1 SOURCE] The SDI is requesting a moratorium on the electronic invoicing reform and an independent security audit. www.economiematin.fr
[● 4 SOURCES] All VAT-registered companies must be able to receive electronic invoices starting September 1, 2026. presseagence.fr · www.lecourrierdesentreprises.fr · www.economiematin.fr · www.notretemps.com
[○ 1 SOURCE] Non-compliance with electronic invoicing obligations can lead to annual fines of up to €15,000 per company. www.economiematin.fr
[● 3 SOURCES] The cyberattack did not affect tax payments or tax assessment notices. www.notretemps.com · www.estrepublicain.fr · www.republicain-lorrain.fr
[○ 1 SOURCE] The DGFiP is sending individual notifications to affected users via email or mail. www.epochtimes.fr
[● 4 SOURCES] At least 678,000 individuals and professionals had their data accessed or extracted. www.epochtimes.fr · www.notretemps.com · www.estrepublicain.fr · www.republicain-lorrain.fr
[○ 1 SOURCE] Small businesses have until September 1, 2027, to comply with electronic invoice issuance requirements. presseagence.fr
[DISPUTED] The DGFiP confirmed two intrusions occurred in late June and late July. www.epochtimes.fr · www.notretemps.com · www.estrepublicain.fr · www.republicain-lorrain.fr