France’s Directorate General of Public Finances (DGFiP), the agency responsible for collecting taxes and managing public revenue, has confirmed a data breach affecting close to 678,000 individuals and businesses. The disclosure, made public on August 14, followed claims from a threat actor days earlier that they had stolen sensitive tax records from the agency’s systems.

How the Breach Happened

According to DGFiP’s account, the intrusion did not rely on a software exploit or a newly discovered vulnerability. Instead, attackers appear to have obtained or impersonated legitimate credentials belonging to a DGFiP employee and an authorized third-party partner, then used that access to pull records directly from internal systems over the course of June and July.

The agency’s routine access monitoring didn’t catch the activity at the time — a reminder that credential-based intrusions, when carried out carefully, can look indistinguishable from normal authorized use. It wasn’t until a malicious actor publicly claimed responsibility for the theft, around August 12–13, that DGFiP launched a deeper forensic review and confirmed unauthorized access had indeed occurred. The agency says it immediately disabled every account tied to the identified incidents once the breach was verified.

What Was — and Wasn’t — Exposed

The data taken varies depending on whether the victim is an individual or a business. For individuals, exposed fields reportedly include reference tax income figures, family quotient details used in French tax calculations, applicable withholding tax rates, and cadastral records such as property addresses and real estate surface area. For businesses, the stolen data includes company names and SIREN registration numbers, France’s standard business identifier.

DGFiP was careful to note what remained untouched: the “Finances publiques” online portal accounts themselves were not compromised, and no usernames or passwords were exposed in the breach. That distinction matters, since it means attackers cannot directly log into victims’ tax accounts using stolen data from this incident — but the financial and property details that were exposed are still valuable on their own.

The Real Risk: Convincing Follow-On Scams

Security researchers and the agency itself have flagged the most likely downstream threat: highly targeted phishing and impersonation campaigns. Armed with a person’s actual income bracket, family tax situation, and property details, a scammer can craft messages that look far more legitimate than a generic phishing email — for example, a fake notice about a tax adjustment or refund that references real figures from the victim’s own filings.

That kind of specificity is exactly what makes tax-themed social engineering effective, and it’s why the agency is urging heightened scrutiny of any unexpected tax-related contact in the coming weeks and months, even if the message appears to reference accurate personal details.

Regulatory and Legal Response

DGFiP has notified France’s data protection authority, the CNIL (Commission Nationale de l’Informatique et des Libertés), and is coordinating its response with the Ministry of Economy and Finance, the High Official for Defense and Security, and ANSSI, the country’s national cybersecurity agency. The agency also plans to file a criminal complaint over the intrusion.

Affected individuals and businesses will not be left to find out informally: DGFiP says it will begin directly notifying victims the week following the disclosure, by email or postal mail, specifying exactly what data was accessed and what precautions to take. Investigators say the final scope of the breach — including the precise volume and categories of stolen data — is still being determined, and further updates are expected as the investigation continues.

Recommendations for Potentially Affected Users

• Treat any unsolicited tax-related email, text, or phone call with skepticism, even if it cites accurate personal or financial details
• Avoid clicking links in unexpected messages claiming to be from tax or government authorities
• Independently verify any request by contacting the relevant agency through official, previously known channels rather than links or numbers provided in the message itself
• Watch for DGFiP’s official notification, which will specify what data was involved in your specific case

The incident underscores a recurring theme in government data breaches: even when core authentication systems remain intact, the exposure of granular financial and property records can be more than enough to power a convincing wave of fraud.