French tax authority confirms breach exposing 600K records, including private messages for 250 taxpayers

The French tax authority confirmed a break-in that exposed roughly 600,000 records. For about 350,000 individuals the data included tax identification numbers, marital status, email and postal addresses, and phone numbers. Around 250,000 businesses and professionals had only company names and SIREN numbers exposed. Cadastral data limited to property addresses and dimensions, which the authority said were already publicly available.

The authority began notifying affected taxpayers by email or post. It warned that criminals could use the stolen details to make phishing attempts more convincing. The breach may lead to additional costs for organizations that manage comparable personal and tax data. The authority also suspended the Vacant Successions Portal after discovering a technical vulnerability in that service.

For approximately 250 individuals the actual content of messages exchanged with the tax authority was also exposed. This increases the risk of convincing social-engineering attacks that reference real correspondence. The breach adds to a series of public-sector cyber incidents in France, showing that multiple sectors can be hit in a short period. While the authority has taken steps to notify and suspend vulnerable services, the exposed information cannot be retracted and may continue to be used in follow-on scams.