DGFiP Confirms Intrusion and Data Extraction
France’s Economy Ministry has formally acknowledged that the Directorate General of Public Finances (DGFiP) suffered an unauthorized intrusion in late June, confirming that a threat actor successfully breached the agency's internal systems. The ministry stated that the attacker gained entry by stealing or misusing an individual's identity, which provided them with sufficient privileges to navigate the network and access sensitive records. This initial foothold allowed the intruder to view and extract data pertaining to both private citizens and corporate entities, marking a significant compromise of the tax authority’s digital infrastructure.
While security officials detected the anomaly and severed the unauthorized connection in late June, the incident remained largely quiet until earlier this week when a hacker operating under the alias ZeroBytes publicly claimed responsibility for the attack. The revelation prompted the DGFiP to implement additional restrictive measures aimed at preventing any further unauthorized access or data exfiltration. Although the agency has not officially attributed the breach to a specific threat group, it is now working to determine the precise scope of the compromise and identify which individuals and businesses were affected.
In response to the disclosure, the DGFiP announced that it will notify France’s data protection authority and file a criminal complaint as part of its ongoing investigation. The agency also indicated that affected parties will be contacted individually to inform them of what specific information may have been exposed and to advise on necessary precautionary steps. This breach adds to a series of high-profile security incidents affecting French government agencies this year, following earlier compromises at the National Agency for Secure Documents and the Education Ministry.
The ZeroBytes Claim: 600,000 Victims
Operating under the alias ZeroBytes, the threat actor has asserted that they successfully exfiltrated records pertaining to more than 600,000 individuals. According to reports from FrenchBreaches, a platform dedicated to monitoring data leaks within France, the hacker detailed a specific methodology for the intrusion. The claimant stated that they accessed internal servers to establish a connection with the agency’s virtual private network, subsequently leveraging an internal search tool to query information on both private citizens and corporate entities. ZeroBytes further alleged that the theft of this sensitive material commenced prior to security officials detecting the anomaly and severing the unauthorized access in late June.
The scope of the allegedly compromised data is extensive, encompassing a wide array of personal identifiers and financial details. The specific categories cited include full names, tax identification numbers, and email addresses. Beyond basic contact information, the claimant indicated that the stolen records also contain sensitive demographic data such as family circumstances and detailed information regarding each individual’s tax status. This breadth of exposure suggests a significant risk to the privacy and financial security of the affected population, particularly given the nature of the tax authority's database.
It is crucial to note that while these specific figures and data categories have been publicized through FrenchBreaches, they remain unverified by official channels. Neither the DGFiP nor other relevant authorities have independently confirmed the authenticity of the purportedly stolen files or validated the 600,000 victim count. The tax authority has not publicly attributed the breach to a specific threat group nor endorsed the hacker’s claims regarding the extent of the data extraction. Consequently, the precise scale and nature of the compromise remain under active investigation as officials work to determine exactly which records were accessed.
How the Attacker Accessed Internal Systems
The intrusion into the Directorate General of Public Finances began in late June when an adversary successfully compromised internal servers, a foothold that granted them direct connectivity to the agency’s virtual private network. By establishing this link through the stolen or misused identity of an authorized user, the threat actor bypassed perimeter defenses and gained visibility into sensitive internal infrastructure. This access vector allowed the individual to navigate the DGFiP’s digital environment with sufficient privileges to locate and interact with critical data repositories.
Once connected via the VPN, the attacker reportedly deployed an internal search utility to systematically query records pertaining to both private citizens and corporate entities. The use of this legitimate administrative tool suggests a targeted approach to harvesting specific identifiers rather than indiscriminate bulk exfiltration. According to the claims made by the actor known as ZeroBytes, the extraction of these sensitive files commenced before security teams detected the anomaly and severed the unauthorized connection in late June.
In response to the public disclosure of the breach, the DGFiP has implemented additional technical restrictions designed to harden its systems against further unauthorized entry. These measures aim to close any remaining gaps that could be exploited by the same actor or other potential threats while investigators work to determine the precise scope of the data accessed. The agency is currently coordinating with France’s data protection authority and law enforcement to assess the full extent of the compromise.
Official Response and Victim Notification
In the immediate aftermath of confirming the intrusion, the Directorate General of Public Finances outlined a structured protocol for engaging with those potentially impacted by the data extraction. The agency has committed to reaching out directly to each affected individual rather than issuing broad public advisories, ensuring that recipients receive specific details regarding which categories of their personal information were exposed. These personalized communications will also include tailored recommendations on protective measures citizens should adopt to mitigate risks associated with the leaked identifiers and tax records.
Beyond direct victim outreach, the DGFiP is executing a formal regulatory and legal response in coordination with national oversight bodies. The agency has stated it will formally notify France’s data protection authority of the incident, fulfilling its statutory obligations under privacy regulations. Simultaneously, officials are preparing to file a criminal complaint with law enforcement agencies to initiate a prosecutorial track against the perpetrators. This dual approach ensures that both administrative compliance and judicial accountability are addressed as the case moves forward.
As these procedural steps unfold, investigators remain focused on establishing the definitive scope of the compromise. Authorities are currently conducting a granular analysis to identify precisely which data fields were accessed or exfiltrated and to calculate the exact number of individuals and corporate entities affected by the breach. This ongoing forensic work is critical for validating the initial claims made by the threat actor and will inform the content of future updates provided to the public as the investigation progresses.
A Pattern of French Government Breaches
The intrusion into the Directorate General of Public Finances marks the most recent chapter in a troubling year for French state infrastructure, where multiple high-profile agencies have fallen victim to sophisticated cyber intrusions. This latest incident follows a string of compromises that have collectively exposed vast troves of sensitive citizen data, raising urgent questions about the resilience of government digital systems against persistent threat actors.
Earlier this year, in April, attackers targeted the National Agency for Secure Documents (ANTS), which manages critical identity services including passports, national ID cards, residence permits, and driver’s licenses. The breach disrupted operations and highlighted vulnerabilities in the platforms responsible for verifying French citizens’ identities. In the same month, the Ministry of Education disclosed that a separate attack on its student account management system had leaked personal information belonging to students, further compounding concerns about data security within public institutions.
The pattern of attacks intensified in February when hackers breached the National Bank Accounts File, a comprehensive database tracking financial holdings across France. This compromise exposed details linked to approximately 1.2 million bank accounts out of a total dataset exceeding 300 million entries. Together with the recent DGFiP breach and the earlier incidents at ANTS and the Education Ministry, these events underscore a sustained campaign targeting French government data repositories, forcing authorities to reassess their defensive postures against increasingly coordinated threats.
Key points
- The French Economy Ministry confirmed that an attacker gained unauthorized access to DGFiP systems in late June by stealing or misusing someone's identity.
- Hacker ZeroBytes claimed responsibility for the breach, alleging they accessed internal servers and VPNs to extract data on more than 600,000 people, including tax identification numbers and family circumstances.
- DGFiP stated that unauthorized access was detected and cut off in late June, but authorities are still determining the precise scope of the data compromised.
- The agency plans to notify affected individuals directly, inform France's data protection authority, and file a criminal complaint as part of its response.
- This incident follows several other breaches affecting French government agencies this year, including attacks on ANTS, the Education Ministry, and the National Bank Accounts File.