France confirms cyber-attack on tax authority with 678,000 victims

Around 678,000 French taxpayers have fallen victim to a cyberattack on the national tax authority. The French Economy Ministry confirmed on Thursday that hackers had gained unauthorised access to systems of the Directorate General of Public Finances (DGFiP).

In brief

• Hackers broke into systems of the French tax authority in late June and were able to view and copy data.
• A hacker under the alias ZeroBytes claimed responsibility and said data of more than 600,000 people had been stolen.
• The breach followed other attacks on French government agencies this year.

How hackers gained access

The unauthorised access occurred after someone’s identity had been stolen or misused. With those credentials, the attackers were able to break into DGFiP systems. According to FrenchBreaches, a website that tracks hacks in France, the hacker behind the alias ZeroBytes said he had gained access to internal servers. This allowed him to connect to the internal VPN network and use an internal tool to look up information.

The French authorities noticed the breach and shut off access in late June. This week, however, the same hacker publicly disclosed what he had done, after which the attack became public.

What data was stolen

According to the hacker, names, VAT numbers, email addresses, family circumstances and tax status of more than 600,000 individuals were stolen. The French authorities say they are investigating to determine exactly which information was accessed or stolen and how many citizens and businesses are affected.

Victims will be contacted individually and told which information may have been exposed. The tax authority will notify France’s data protection regulator, file a report and provide more information as the investigation progresses.

Series of attacks on French government

The DGFiP breach is not unique this year. In April, hackers hit the website of France’s National Agency for Secure Documents (ANTS), which processes passports and driving licences. The same month, the Education Ministry announced that a student account system had been attacked. In February, hackers also breached parts of the National Bank Accounts File, a database containing billions of bank accounts in France. That breach affected information from around 1.2 million accounts out of more than 300 million total records.

French authorities have since made arrests. Earlier this year, a 20-year-old man was arrested on suspicion of dozens of data breaches at government agencies, sports federations and private companies.