In short: Hacker group ZeroBytes breached France's tax authority (DGFiP) twice — in late June and late July 2026 — exploiting stolen employee credentials and bypassing 2FA. At least 678,000 individuals and organizations had their income, tax rates, family details, and property data exposed. On August 12, the stolen records appeared for sale on PwnForums. French authorities have opened a criminal investigation.
How Hackers Breached the French Tax Authority — Twice
The Direction générale des finances publiques (DGFiP) manages tax declarations, income calculations, and property data for all French citizens and businesses. In summer 2026, it became the target of a double intrusion.
According to SecurityLab and Xakep investigations, the first breach occurred in late June 2026 when an attacker used stolen employee credentials combined with 2FA bypass techniques. A second intrusion followed in late July using a similar method. Critically, each incident was only discovered during a routine audit — not by real-time monitoring — meaning the attackers likely had prolonged undetected access.
This incident illustrates a hard truth about 2FA: it is not a foolproof shield. When an attacker already holds a valid password, they can leverage techniques like push bombing or OTP interception. We covered these attack patterns in detail in our article on MFA fatigue and push bombing.
What Data Was Stolen
DGFiP officially confirmed 678,000 individuals and organizations were affected, with over 350,000 already notified by August 18. ZeroBytes' own claim is a database of more than 2 million records — a discrepancy typical of breach disclosures.
The stolen data includes:
- Full names of taxpayers;
- Calculated taxable income;
- Family coefficient (household composition);
- Withholding tax rate at source;
- Property data: address and floor area;
- For businesses: company name and SIREN registration number.
This is not merely contact information. Attackers now hold a precise financial profile of each victim — income level, family structure, and property holdings — making this dataset highly valuable for targeted fraud.
August 12: Records Listed for Sale
On August 12, 2026, the data appeared on PwnForums — a well-known underground marketplace for stolen databases. ZeroBytes offered not only the stolen records but also what they claim is ongoing access to DGFiP infrastructure, suggesting the ability to extract fresh data. The Paris prosecutor's office has opened a criminal investigation. Prime Minister Sébastien Lecorню tasked ANSSI (France's national cybersecurity agency) with auditing the ministry's systems.
Why Tax Data Is Valuable to Cybercriminals
Tax records might seem like dry government data — but income and family details are exactly what make social engineering convincing:
- Targeted phishing: a fraudster who quotes your exact tax refund amount or withholding rate sounds instantly credible, impersonating the tax authority or a bank adviser.
- Extortion: income data enables threats like "you have been flagged for undeclared income," especially effective if victims are uncertain about past filings.
- Real-estate fraud: property addresses and floor areas provide anchor points for fake notary or conveyancing scams.
- Corporate intelligence: SIREN numbers and company data help attackers map business relationships and prepare targeted attacks on specific organizations.
For a full guide on checking whether your personal data has been exposed and what steps to take, see our article How to Check If Your Data Was Leaked.
How to Protect Yourself
The DGFiP breach is a reminder that governments and large institutions can fail to protect data you were required to share with them. You cannot prevent a breach at the agency level, but you can reduce the damage:
- Expect targeted phishing: after breaches involving financial data, calls and emails impersonating "the tax authority" or "your bank" spike sharply. Official agencies never ask for an SMS code or an instant transfer by phone.
- Audit your passwords: the DGFiP breach started with stolen employee credentials. Password reuse across services is your risk — even if you are not a French taxpayer.
- Upgrade your 2FA: replace SMS codes and push notifications with hardware keys (YubiKey, Passkey) or TOTP apps. These are significantly harder to bypass.
- Encrypt your traffic: LiMP VPN hides your IP address and encrypts your connection, reducing the risk of interception on networks you do not control. Explore our protection features.