French tax authority confirms 2M taxpayer records stolen after attacker advertises data

France’s tax authority has confirmed a data breach involving 2 million taxpayer records after an attacker advertised the stolen data on a cybercrime forum. The admission follows claims by the alleged perpetrator, operating under the alias 'ZeroBytes,' that they accessed the General Directorate of Public Finances (DGFiP) systems using stolen credentials and an MFA bypass technique. While the authority disputes the attacker’s assertion of continued access, it acknowledges that data was extracted during the intrusion in June. This discrepancy highlights the challenge of verifying attacker claims during ongoing investigations.

The breach raises concerns about the security of government systems handling sensitive financial data. The use of stolen credentials and MFA bypass techniques suggests vulnerabilities in authentication mechanisms, which are critical for protecting high-value targets like tax authorities. For engineers, this incident serves as a reminder that even systems with multi-factor authentication can be compromised if credentials are leaked or phished. The DGFiP’s response, implementing new restrictions and launching an in-depth investigation, reflects standard post-breach protocols, but the scale of the data loss underscores the potential consequences of such lapses.

This incident is part of a broader trend of cyberattacks targeting French public-sector institutions in 2026. Earlier breaches affected the Ministry of Finance, Health Ministry, Interior Ministry, and other agencies, exposing millions of records, including medical and identity data. The repeated targeting of government systems suggests a systemic challenge in securing critical infrastructure. For engineers working in or with public-sector organizations, these breaches emphasize the need for robust access controls, continuous monitoring, and rapid response mechanisms to mitigate the impact of credential-based attacks.

The DGFiP’s decision to report the breach to France’s data protection watchdog, CNIL, and notify affected users aligns with regulatory requirements. However, the delay between the breach in June and its public confirmation in August raises questions about detection and disclosure timelines. For engineers, this underscores the importance of real-time monitoring and automated alerting to identify and respond to intrusions quickly. The incident also highlights the reputational and operational risks of delayed breach notifications, which can erode public trust and complicate remediation efforts.