France Tax Authority Breach: Hacker Claims 600,000 Victims' Data Stolen
France's Directorate General of Public Finances (DGFiP) confirmed that an attacker breached its information systems in late June, exfiltrating data belonging to individuals and businesses. The French Economy Ministry stated the intruder gained unauthorized access after stealing or misusing someone's identity, then "viewed and extracted data" from the agency's systems before the intrusion was detected and terminated in late June. The agency has pledged to contact every affected party individually and notify France's data protection authority (CNIL). Individuals concerned about exposure can verify their status using a email breach checker.
The incident came to light this week after a hacker using the alias ZeroBytes claimed responsibility via FrenchBreaches, a site that tracks data leaks in France. According to the claim—yet to be independently verified—the attacker obtained records on more than 600,000 people, including names, tax identification numbers, email addresses, family circumstances, and tax status details. ZeroBytes reportedly gained access to internal DGFiP servers, connected through the agency's VPN, and used an internal tool to query records on individuals and businesses before being cut off. The DGFiP has not publicly attributed the breach or confirmed the hacker's claims. Security professionals can audit their own network exposure with a DNS leak test.
The breach is the latest in a string of incidents targeting French government agencies in 2025. In April, attackers compromised the National Agency for Secure Documents (ANTS) website, which handles applications for passports, national ID cards, residence permits, and driver's licenses. That same month, the Education Ministry disclosed a separate breach exposing student account data. Earlier in February, hackers breached part of the National Bank Accounts File, leaking information tied to roughly 1.2 million accounts out of more than 300 million entries in the database. French authorities are continuing to pursue hackers suspected of targeting public institutions and other organizations. Users with potentially compromised credentials should run them through a password checker and rotate any reused passwords immediately.