--- title: France’s tax agency lost data on 678,000 people to a... description: France's tax agency, DGFiP, confirms an attacker stole data on 678,000 individuals and businesses using stolen credentials from an employee and an authorised... canonical: https://daily.dev/posts/france-s-tax-agency-lost-data-on-678-000-people-to-a-stolen-login-gpgwpa5ex twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: France’s tax agency lost data on 678,000 people to a stolen login | daily.dev og:description: France's tax agency, DGFiP, confirms an attacker stole data on 678,000 individuals and businesses using stolen credentials from an employee and an authorised... og:url: https://daily.dev/posts/france-s-tax-agency-lost-data-on-678-000-people-to-a-stolen-login-gpgwpa5ex og:image: https://api.daily.dev/og/posts/gPgWpA5eX.png og:image:alt: France’s tax agency lost data on 678,000 people to a stolen login og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # France’s tax agency lost data on 678,000 people to a stolen login **[The Next Web](https://daily.dev/sources/tnw)** · 5 min read · 0 upvotes · 0 comments ## Summary France's tax agency, DGFiP, confirms an attacker stole data on 678,000 individuals and businesses using stolen credentials from an employee and an authorised third party, reportedly bypassing multi-factor authentication. The intrusions occurred in June and July, but the agency only learned of the theft in August when the attacker, using the alias ZeroBytes, advertised the database on a cybercrime forum. Exposed data includes reference tax income, family quotient, withholding tax rate, company names, SIREN numbers, and cadastral property records. Taxpayer portal usernames and passwords were not compromised. The attacker's own claimed numbers (over 2 million people, from a pool of 20 million) diverge sharply from the government's figure. Prime Minister Sébastien Lecornu convened a crisis meeting, ordered an ANSSI audit due in September, and a Paris prosecutor has opened a criminal investigation. This follows similar credential-based breaches at FICOBA, France Titres, and France's statistics office. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did attackers breach France's tax agency DGFiP without using a zero-day exploit? Attackers used stolen login credentials belonging to a DGFiP employee and an authorised third party, such as a notary, bailiff, or local authority with system access, and reportedly bypassed multi-factor authentication. No software vulnerability was involved; the intrusions occurred in June and July, and the agency only discovered the theft in August after the attacker advertised the stolen data on a cybercrime forum. _daily.dev surfaces breach writeups like this for teams reassessing third-party access and MFA weaknesses._ ### What personal data was exposed in the DGFiP France tax agency breach? Exposed data covers reference tax income, family quotient, and withholding tax rate for individuals, plus registered company names and SIREN numbers for businesses, along with cadastral records showing property addresses and floor areas. Taxpayer usernames and passwords on the impots.gouv.fr portal were not compromised. The agency confirmed 678,000 individuals and businesses affected, though investigations continue. _Track how governments disclose breach scope and affected data types via daily.dev for incident-response planning._ ## Similar posts on daily.dev - [France’s statistics department hit by cyberattack on staff directory](https://daily.dev/posts/france-s-statistics-department-hit-by-cyberattack-on-staff-directory-jydqpb9vd) · The Next Web · 0 upvotes · 0 comments - [France's 'Secure' ID agency probes claimed 19M record breach](https://daily.dev/posts/france-s-secure-id-agency-probes-claimed-19m-record-breach-wwv4gvjvl) · The Register · 0 upvotes · 0 comments - [French govt messaging service breached in account hijacking attack](https://daily.dev/posts/french-govt-messaging-service-breached-in-account-hijacking-attack-3qxin6pom) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/france-s-tax-agency-lost-data-on-678-000-people-to-a-stolen-login-gpgwpa5ex) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"France’s tax agency lost data on 678,000 people to a stolen login","url":"https://daily.dev/posts/france-s-tax-agency-lost-data-on-678-000-people-to-a-stolen-login-gpgwpa5ex","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/france-s-tax-agency-lost-data-on-678-000-people-to-a-stolen-login-gpgwpa5ex"},"datePublished":"2026-08-17T21:10:44.482Z","dateModified":"2026-08-20T12:35:03.949Z","description":"France's tax agency, DGFiP, confirms an attacker stole data on 678,000 individuals and businesses using stolen credentials from an employee and an authorised...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/42adc8d25551efdce134524fc57108a8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/42adc8d25551efdce134524fc57108a8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/france-s-tax-agency-lost-data-on-678-000-people-to-a-stolen-login-gpgwpa5ex","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,data-breach","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"France’s tax agency lost data on 678,000 people to a stolen login"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/france-s-tax-agency-lost-data-on-678-000-people-to-a-stolen-login-gpgwpa5ex#faq","mainEntity":[{"@type":"Question","name":"How did attackers breach France's tax agency DGFiP without using a zero-day exploit?","acceptedAnswer":{"@type":"Answer","text":"Attackers used stolen login credentials belonging to a DGFiP employee and an authorised third party, such as a notary, bailiff, or local authority with system access, and reportedly bypassed multi-factor authentication. No software vulnerability was involved; the intrusions occurred in June and July, and the agency only discovered the theft in August after the attacker advertised the stolen data on a cybercrime forum. daily.dev surfaces breach writeups like this for teams reassessing third-party access and MFA weaknesses."}},{"@type":"Question","name":"What personal data was exposed in the DGFiP France tax agency breach?","acceptedAnswer":{"@type":"Answer","text":"Exposed data covers reference tax income, family quotient, and withholding tax rate for individuals, plus registered company names and SIREN numbers for businesses, along with cadastral records showing property addresses and floor areas. Taxpayer usernames and passwords on the impots.gouv.fr portal were not compromised. The agency confirmed 678,000 individuals and businesses affected, though investigations continue. Track how governments disclose breach scope and affected data types via daily.dev for incident-response planning."}}]} ```