DGFiP cyberattack compromises data of 678,000 taxpayers

The French Directorate General of Public Finances (DGFiP) has confirmed a major cyberattack by the group ZeroBytes, resulting in the theft of data belonging to approximately 678,000 individuals and professionals. The breach, which occurred through the unauthorized use of credentials from an agent and an authorized third party, exposed sensitive information including tax identifiers, names, dates of birth, addresses, and income levels. Additionally, approximately 200,000 cadastral records were compromised.

In response to the breach, lawyer Jérémy Roche has launched a collective legal action on behalf of roughly 1,000 victims seeking compensation for moral and material damages, such as identity theft risks and phishing attempts. The Paris prosecutor's office has opened an investigation into the fraudulent data extraction.

Separately, France is preparing for the implementation of a mandatory electronic invoicing reform starting September 1, 2026. While all VAT-registered companies must be able to receive electronic invoices by this date, the obligation to issue them will roll out progressively. To address cybersecurity concerns following the DGFiP breach, Minister David Amiel has met with approved platforms to emphasize strict security requirements, including the use of the SecNumCloud label to ensure data is stored on European soil and protected from foreign extraterritorial laws.