Cyberattacks Target French Tax and Government Systems

French authorities have disclosed a series of cyberattacks against government agencies, resulting in the theft of financial and personal data belonging to hundreds of thousands of individuals and businesses. The breaches, which occurred during June and July, primarily targeted France’s Public Finance agency, known as the DGFiP, which oversees the national tax system.

According to the agency, two primary intrusions took place. The first attack in June compromised details from more than 678,000 individual and corporate accounts, exposing taxpayer names, income reference data, and tax rates. A second incident in July involved information from 200,000 land registry accounts. The head of the agency, Amélie Verdier, stated that officials detected an additional data breach that remains under evaluation.

A self-described French hacking duo operating under the name ZeroBytes claimed responsibility for the cyberattacks on a dark-web forum. The group claimed that they accessed the network by using a virtual private network utilized by tax officials. Asked by news agency AFP about their motives, the group cited financial gain, stating, “money, I imagine.” The hackers asserted that the compromised information had already been sold to two individuals for thousands of euros.

The hackers claimed their reach is broader than the figures disclosed by the government. ZeroBytes asserted that they hold details on 250,000 land registry accounts involving approximately two million property owners in France. The group also claimed to have acquired data on millions of students and tens of thousands of teachers, including records dating back 20 years.

Following the disclosures, French Prime Minister Sébastien Lecornu directed the National Cybersecurity Agency to establish a new specialized cyber unit to defend against digital attacks. Budget Minister David Amiel announced that the government will begin using artificial intelligence tools to test digital vulnerabilities across state agencies. Amiel noted that France will strictly use domestic or European “sovereign” AI developers, specifically identifying French firm Mistral, while explicitly excluding US-based providers such as OpenAI.

Background

The latest breaches follow a series of high-profile cyber incidents affecting French public infrastructure earlier this year. In February, a breach at the finance ministry exposed 1.2 million bank account details, followed days later by an attack that compromised medical records belonging to approximately 15 million individuals. In April, the national identity document agency ANTS suffered a cyberattack that exposed information on nearly 12 million individuals and businesses.