started · updated
France tax authority suffers cyberattack exposing 678,000 taxpayers
The French General Directorate of Public Finances (DGFiP) has confirmed a major cyberattack that occurred in late June 2026. The breach, which involved the identity theft of an employee, allowed unauthorized access to the tax authority’s information systems.
While official figures are still being verified, the specialized cybersecurity site FrenchBreaches estimates that approximately 678,437 taxpayers—including both individuals and professionals—have had their data compromised. The stolen information reportedly includes names, birthdates, addresses, phone numbers, email addresses, and sensitive fiscal data such as reference income, tax withholding rates, and family status.
Among the affected individuals, reports suggest a significant number of high-income earners are included, with thousands earning over €100,000 and several earning over €1 million. This exposure raises serious concerns regarding identity theft and targeted scams. There is also heightened concern for cryptocurrency investors, as the precise data could facilitate 'wrench attacks' or highly convincing phishing attempts.
Amélie Verdier, Director General of the tax administration, has apologized for the incident and stated that the DGFiP is taking measures to secure its systems. The administration plans to contact all affected individuals directly via email or post to inform them of the specific data accessed and the necessary precautions to take.
Entities
Amélie Verdier · Bercy · CNIL · Direction Générale des Finances Publiques · France · French Breaches · FrenchBreaches · Ministry of Economy and Finance · Santé publique France · ZeroBytes
Claims
What the coverage asserts, and how well corroborated each claim is across sources.
- [● 3 SOURCES] Santé publique France confirmed a cyberattack on a platform managed by a third-party provider.
- [● 24 SOURCES] The DGFiP confirmed a cyberattack occurred in late June 2026. www.parismatch.com · www.planet.fr · policeetrealites.com · www.dna.fr · eco.sapo.pt · +17 more
- [● 3 SOURCES] No medical records or social security numbers were compromised in the Santé publique France attack.
- [● 3 SOURCES] The breach involved an unauthorized access to an internal search tool via a compromised VPN. www.parismatch.com · www.economiematin.fr · www.macg.co
- [● 3 SOURCES] The Santé publique France breach exposed approximately 80,000 professional contact records.
- [● 15 SOURCES] A hacker using the pseudonym ZeroBytes claims to have stolen 678,438 lines of tax data. www.parismatch.com · www.economiematin.fr · policeetrealites.com · www.macg.co · www.generation-nt.com · +9 more
- [● 5 SOURCES] The DGFiP has implemented new security restrictions to prevent further unauthorized access. www.generation-nt.com · 1001infos.net · www.24matins.fr · www.planet.fr
- [● 3 SOURCES] A second alleged leak involving approximately two million property and land owners in France has been claimed. eco.sapo.pt · pplware.sapo.pt · www.prensa-latina.cu
- [● 18 SOURCES] The specialized site French Breaches reports that approximately 678,437 people are potentially affected. www.generation-nt.com · policeetrealites.com · 1001infos.net · www.dna.fr · www.parismatch.com · +12 more
- [● 14 SOURCES] The breach allowed the consultation and extraction of data belonging to both individuals and professionals. www.generation-nt.com · policeetrealites.com · 1001infos.net · www.24matins.fr · www.dna.fr · +8 more
- [● 12 SOURCES] Affected users will receive individual notifications regarding the data potentially accessed or extracted. policeetrealites.com · 1001infos.net · www.24matins.fr · www.dna.fr · www.parismatch.com · +7 more
- [● 5 SOURCES] The attacker claims to have gained access to an internal search tool via a compromised VPN. www.parismatch.com · fr.news.yahoo.com · lesinguliersete.fr · aftabnews.ir · abmedia.io