started · updated
French tax authority data breach affects 678,000 people
A major cyberattack targeting the French Directorate General of Public Finances (DGFiP) has resulted in the theft of data belonging to approximately 678,000 individuals and businesses. The breach, which occurred between June and July 2026, involved a malicious actor gaining access to the system by impersonating an agent and an authorized third party.
Stolen information includes names, family quotients, reference tax income, withholding tax rates, and, for businesses, company names and SIREN numbers. Cadastral data, such as property addresses and surfaces, were also accessed. However, authorities have clarified that personal accounts on the official tax website and user passwords were not compromised.
The Paris Prosecutor's Office has opened an investigation into the fraudulent extraction of data and criminal association. Cybersecurity experts warn that the stolen data may have already been sold, raising the risk of phishing scams and fraud targeting taxpayers.
Starting Monday, August 17, the tax administration will begin contacting affected individuals directly to provide details on the exposed data and necessary precautions. Officials have advised citizens to be vigilant and verify that any official communication ends with the '@dgfip.finances.gouv.fr' domain.
Entities
Amélie Verdier · Direction Générale des Finances Publiques · France · Paris prosecutor's office · Sébastien Lecornu
Claims
What the coverage asserts, and how well corroborated each claim is across sources.
- [○ 1 SOURCE] The cyberattack occurred through the impersonation of an agent's credentials and those of an authorized third party. www.clubic.com
- [○ 1 SOURCE] The stolen data has reportedly already been sold by the hacker. www.capital.fr
- [○ 1 SOURCE] Affected users will be contacted individually starting Monday, August 17. www.midilibre.fr
- [● 2 SOURCES] The Paris Prosecutor's Office opened an investigation into the fraudulent extraction of personal data from a state automated system. www.capital.fr · www.midilibre.fr
- [○ 1 SOURCE] Personal spaces on impots.gouv.fr and user passwords were not compromised. www.clubic.com
- [● 2 SOURCES] Approximately 678,000 individuals and professionals had their data consulted or extracted. www.clubic.com · www.midilibre.fr
- [○ 1 SOURCE] Stolen data includes names, family quotients, reference tax income, and withholding tax rates. www.midilibre.fr