[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [TECHNOLOGY]

7 clusters · 149 sources · 29 days · First seen · Last updated

French tax authority and FICOBA data breach

Overview

In mid-August 2026, the French General Directorate of Public Finances (DGFiP) confirmed a series of cyberattacks occurring throughout the summer. The most significant breach, occurring between late June and early July, was facilitated by the identity theft of an employee and the impersonation of an authorized third party. This intrusion, claimed by the hacking group ‘ZeroBytes’, resulted in the unauthorized extraction of sensitive data belonging to approximately 678,438 individuals and businesses, as well as roughly 200,000 cadastral accounts. Stolen information includes names, birthdates, addresses, phone numbers, email addresses, family status, and fiscal details. As the government implements a major tax reform requiring electronic invoicing, new security mandates have been emphasized. Starting September 1, 2026, large and mid-sized enterprises must use state-approved platforms to issue and receive electronic invoices. To mitigate future risks, the government is requiring these platforms to use the SecNumCloud label to ensure data remains on European soil. However, reports indicate nearly half of the affected companies have not yet begun the compliance process. Legal and criminal developments have accelerated. An 18-year-old suspect, believed to be a member of ‘ZeroBytes’ with a prior criminal record for cyberattacks, has been placed in pre-trial detention in Paris. He faces potential charges including organized criminal association and fraudulent data extraction, which could carry a 10-year prison sentence and a 300,000 euro fine. A second suspect, under the age of 16, was also detained but has since been released. Investigators are currently analyzing seized computer equipment. French Foreign Minister Jean-Noël Barrot confirmed he is among the victims. In response to the incident, the French government has initiated a 200 million euro plan to bolster the security of state information systems. Additionally, a collective of victims has launched a class-action lawsuit against the state seeking damages for security failures.

Entities

Direction Générale des Finances Publiques · France · Amélie Verdier · David Amiel · Paris prosecutor's office

Claims

What the coverage asserts, and how many sources carry each claim.

Coverage disagrees

Sources make claims that cannot both be true. CLSTR reports the disagreement; it does not decide who is right.

  • "The cyberattack occurred through the impersonation of an agent's credentials and those of an authorized third party."

    vs

    "The attacker gained access by usurping the credentials of a government official outside the tax authority."

    The first claim asserts the attack used an agent's credentials and a third party's, while the second asserts it used credentials from a government official outside the tax authority.

Timeline

  1. 21 days ago

    [TECHNOLOGY] 9 sources
    CNIL announces audits of French tax and identity agencies after major data breaches

    France's CNIL is auditing the DGFiP and ANTS following major data breaches affecting millions of citizens and hundreds of thousands of taxpayers.

  2. 26 days ago

    [CRIME] 14 sources
    France tax hack: 18-year-old suspect detained in Zerobytes data breach

    An 18-year-old suspect has been detained in Paris for his alleged role in the Zerobytes hack, which stole the tax data of 678,000 French citizens and professionals.

  3. about 1 month ago

    [BUSINESS] 20 sources
    France implements electronic invoicing reform following major DGFiP data breach

    France is implementing mandatory electronic invoicing by September 2026 amid concerns over a major DGFiP data breach affecting 678,000 taxpayers and subsequent legal actions against the state.

  4. about 1 month ago

    [POLITICS] 4 sources
    French tax administration hit by series of cyberattacks

    The French tax administration (DGFiP) confirmed three cyberattacks, with a major breach affecting at least 350,000 taxpayers and exposing sensitive personal and financial data.

  5. about 1 month ago

    [TECHNOLOGY] 65 sources
    DGFiP cyberattack exposes data of 678,000 French taxpayers

    A major cyberattack on France's tax authority (DGFiP) has exposed the personal and tax data of 678,000 individuals and businesses, prompting a government crisis response and judicial investigation.

  6. about 2 months ago

    [TECHNOLOGY] 55 sources
    France tax agency cyberattack exposes data of 678,000 users

    A sophisticated cyberattack on France's tax agency (DGFiP) has exposed the personal and financial data of 678,000 taxpayers and businesses, prompting a criminal investigation by the Paris prosecutor.

  7. about 2 months ago

    [TECHNOLOGY] 44 sources
    France tax authority suffers cyberattack exposing 678,000 taxpayers

    France's tax authority (DGFiP) confirmed a cyberattack in June 2026 that compromised the data of approximately 678,000 taxpayers, exposing sensitive personal and financial information.

Sources

1001infos.net · 1001web.fr · 24matins.fr · 7fm.be · abmedia.io · actu.fr · actusen.com · aduc.it · aeiou.pt · aftabnews.ir · aktivni.si · android-mt.ouest-france.fr · arenapublica.com · article19.ma · bienpublic.com · bitcoinethereumnews.com · borncity.com · bvoltaire.fr · capital.fr · caszazemljo.si · cesdefrance.fr · challenger.pl · cherrypy.org · chiao.com · clementine.fr · clubic.com · cmjornal.xl.pt · coincu.com · coinedition.com · cointribune.com · cointrust.com · compartir-tecnologias.es · crime-nieuws.nl · cryptoast.fr · cryptonomist.ch · cybernoz.com · cybersecuritynews.com · dagensps.se · dartsnmore.com · developpez.net · DNA.fr · dna.fr · dnoticias.pt · echosplus.com · eco.sapo.pt · economiematin.fr · econostrum.info · eloutput.com

This summary has been updated 24 times: see revision history