France is facing a new leak of sensitive data. A hacker claims to have extracted information concerning nearly 678,000 taxpayers after fraudulent access to the DGFiP system. Bercy confirms the intrusion and the exit of data, but not yet this figure. Individuals and professionals are among the potential victims.
In brief
- Nearly 678,000 people are included in the pirate’s claim.
- The fraudulent access dates back to the end of June and allegedly followed identity theft.
- A second leak involving more than 2 million people remains to be confirmed.
France: the DGFiP confirms fraudulent access
The affair broke out on August 12 when a cybercriminal using the pseudonym ZeroBytes claimed responsibility for hacking the General Directorate of Public Finances. France has already experienced several massive leaks of personal data.
The hacker claims a total of 678,000 people: 392,867 individual accounts and 285,570 professional accounts. Bercy remains more cautious.
The DGFiP confirms that illegitimate access did take place at the end of June. The intrusion would have followed the theft of the identity of a person who already had access to the information system. The administration had cut off this access during an inspection carried out the same month.
Despite everything, data could be consulted and extracted. The Ministry of Finance is continuing its investigations to precisely identify the people concerned. This is why the 678,000 potential victims remain, for the moment, a figure coming from the hacker and not the final assessment of the administration. The distinction matters.
Tax data much more sensitive than a simple email
The information presented by ZeroBytes goes well beyond a list of email addresses. The sample released would include names, dates of birth, addresses, marital status and number of dependents. Real estate data, land identifiers, withholding tax rate and reference tax income would be added.
Some old requests sent to the tax services would also appear. This type of base is obviously of interest to scammers. A fake bank advisor or tax agent becomes much more credible when he already knows your address, your assets or your tax situation.
The subject also resonates with the debate on the collection of financial information. In July, Bull Bitcoin appealed to the Council of State against the French application of DAC8, citing the risk created by large databases linking identity and financial data. The DGFiP plans to individually inform the users concerned, specifying the information likely to have been consulted or extracted.
ANSSI and the Department of the Senior Defense and Security Official are also participating in the investigations. The CNIL will receive a notification and the administration plans to file a complaint.
A second flight of 2 million people claimed
ZeroBytes does not stop at the first file. The hacker also claims access to the DGFiP’s Professional Cadastral Data Server. He claims to have extracted 252,149 rows corresponding to 2,041,778 people.
Names, first names, dates and places of birth, addresses, plot references and links between owners and property would appear in this second database. The DGFiP does not confirm this intrusion at this stage. The hacker also claims to have bypassed multi-factor authentication to gain this access. Here again, we will have to wait for the technical conclusions before considering this version as established.
France therefore finds itself with a confirmed cyberattack and a second claim still being verified.
The problem goes beyond simple tax confidentiality. Asset information can facilitate highly personalized scams and, in some cases, help identify individuals with significant assets. This risk already exists in crypto, where France has strengthened the protection of professionals after 77 violent cases recorded in 2026.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
