VULNpocalypse
Breaches and incidentsBriefChecked against a primary source

France DGFiP (tax administration): stolen credentials used to extract tax data on 678,000 people and businesses

The Ministry of Economy said an attacker accessed the DGFiP information system in June and July 2026 and consulted or extracted data on 678,000 individuals...

Disclosed

What happened

  • The Ministry of Economy said an attacker accessed the DGFiP information system in June and July 2026 and consulted or extracted data on 678,000 individuals and businesses: reference tax income, family quotient and withholding rates for individuals, company names and SIREN numbers, and cadastral data. Online account logins and passwords were reportedly not compromised. The attacker publicised the theft on 12 and 13 Aug.
  • Root cause: stolen credentials of a DGFiP agent and of an authorised third party, used to impersonate them; access controls did not catch the theft.
  • Attacker: not named by the ministry.
  • Response: compromised accounts cut, preventive shutdown of some sensitive systems, CNIL notified, ANSSI engaged, criminal complaint filed. This was one of a series of French public-sector breaches that led the Prime Minister to order ANSSI’s REACTIV operation on 1 Sep 2026 (CERT-FR CERTFR-2026-CTI-006).

Sources

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.