France’s Ministry of the Economy and Finance revealed a breach of the systems of the Directorate General of Public Finance (DGFiP), resulting in access to data belonging to 678,000 individuals and professionals. Initial investigations found that the data included tax and property information, while the ministry said that users’ online accounts, login credentials, and passwords were not compromised.
Authorities discovered the incident after a person using the name ZeroBytes claimed responsibility for the attack and offered a stolen database for sale on the PwnForums hacking forum on August 12. In-depth investigations began on that date to determine the scope of access and the data that had been viewed or extracted.
What data was affected?
According to the French Ministry of Finance, the data accessed included information such as reference taxable income, the family quotient, and the tax withholding rate. For companies, the data included the company name and its SIREN number.
Access also extended to cadastral data linked to addresses and property areas. The Directorate General of Public Finance notified France’s data protection authority (CNIL) of the incident as soon as it was identified, while the tax administration closed access points to sensitive information systems and continued assessing the impact with the assistance of the French National Agency for the Security of Information Systems (ANSSI).
Additional claims concerning the land registry
ZeroBytes also claimed to have gained access to the Serveur Professionnel de Données Cadastrales (SPDC), a platform operated by the French tax authority that provides access to the central land registry and property ownership records in the country.
The attacker said that the platform provided access to data on approximately 20 million French citizens, but claimed that they were able to extract only 252,149 records concerning the data of more than two million people. These figures and additional claims remain separate from the scope officially confirmed by the Ministry of Finance, which amounts to 678,000 individuals and professionals.
What does this mean for those affected?
Tax and property data may reveal sensitive details about financial and family circumstances and property ownership, even though passwords or login information were not leaked. The Ministry of Finance therefore said it would contact all those affected starting the week after the announcement, by email or letter, to inform them of the data that may have been accessed or stolen and the necessary precautionary measures.
The incident comes amid a series of breaches affecting French government entities in recent months. In January, the data protection authority imposed a €5 million fine on the national employment agency France Travail after personal information belonging to 43 million people was stolen. The following month, the Ministry of Finance announced another breach affecting more than 1.2 million user accounts, after a database was stolen from the systems of the national bank-account registry FICOBA. France Titres later also announced a breach involving a database containing 19 million records, which was allegedly stolen from the National Agency for Secure Documents (ANTS).