French Tax Authority Data Breach Exposes 678,000 Individuals and Businesses

Post Views: 7

French prosecutors have initiated an inquiry into a cyberattack targeting the national tax administration following the unauthorized extraction of information from a state-managed personal data system.

Personal and Tax Information Exposed

The compromised data includes details for 678,000 users of France’s tax system, encompassing both private citizens and corporate entities. For individual taxpayers, the exposed information consists of full names, family quotient classifications, reference taxable income, and withholding tax rates, as disclosed by Amélie Verdier, Director-General of Public Finances.

The Directorate-General for Public Finances (DGFiP) clarified that the breach did not grant access to secure taxpayer accounts on the Impots.gouv.fr platform.

Affected individuals will be notified starting the following week, with officials highlighting risks of identity theft and fraudulent attempts to solicit additional personal details. Business-related data, deemed less sensitive, included company SIREN registration numbers, business addresses, and the locations of authorized representatives.

Authorities emphasized that while this information alone cannot access secure tax accounts, it could be leveraged to enhance the credibility of phishing attempts through emails, messages, or phone calls. Officials reiterated confidence in the tax platform’s integrity while advising affected parties to remain vigilant against requests for passwords, banking details, or other confidential data.

Authorities Warn of Fraud Risks

This incident follows recent cyberattacks on French public institutions, including systems linked to the National Agency for Secure Documents (ANTS) and the national statistics agency INSEE. The latest breach is expected to prompt heightened scrutiny of security protocols for state-held data, as cybercriminals increasingly target public administrations with large repositories of personal information.

Government Seeks Stronger Security Measures

Public Accounts Minister David Amiel has directed the DGFiP to notify affected taxpayers by Monday and requested proposals for enhanced security measures and lessons learned from the attack, which officials termed unprecedented. Immediate priorities include informing impacted individuals about the breach and monitoring for potential misuse of stolen data.

Investigators are now working to determine how attackers accessed the tax administration’s systems, identify perpetrators, and assess whether the data has been disseminated or exploited elsewhere.