France’s Ministry of the Economy and Finance has confirmed that a cyberattack allowed the theft of taxpayer data belonging to both individuals and professionals.
A “malicious actor” reported as operating under the name ZeroBytes claimed on August 12 that they had gained unauthorised access to systems of the Directorate General of Public Finances (Direction générale des Finances publiques, DGFiP), which runs impots.gouv.fr, in late June 2026 after an identity theft.
Investigations by the ministry have verified the intrusion, which enabled the consultation and extraction of personal and professional taxpayer information.
The unauthorised access was detected and cut off in late June during routine security checks, but data had already been taken. The administration made no announcement at the time and disclosed the breach only after the claim appeared on a criminal forum.
The ministry said deeper investigations were continuing, in coordination with the national cybersecurity agency Agence nationale de la sécurité des systèmes d’information (ANSSI), to establish exactly which data were compromised and how many people are affected.
It said each taxpayer concerned would be notified individually, with details of the information that may have been accessed or extracted and of any necessary precautions. No timetable has been given.
According to the specialised monitoring platform FrenchBreaches, which cited information from the alleged hackers, roughly 678,000 records were stolen.
It concerned approximately 393,000 individuals and 286,000 professionals.
The ministry has not confirmed these figures. Reported data include names, addresses, dates of birth, reference tax income, withholding tax rates, family situation and, in some cases, property-related details.
The sample examined by FrenchBreaches also contained internal tax identifiers, the number of dependants and a record of past dealings with the administration. The dataset has reportedly been put up for sale for several thousand euros.
ZeroBytes said the entry point had been stolen professional credentials that gave access to a virtual private network and then to an internal search tool. The DGFiP has not corroborated that account.
The DGFiP has already strengthened access controls to prevent further unauthorised entry.
The ministry said it would report the incident to the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), and file a formal complaint.
A second claim involving cadastral data has also circulated but has not been confirmed by authorities. It refers to an intrusion dated July 29 into the DGFiP’s professional cadastral data server, and to 252,149 records covering just over two million property holders.
The latest breach at the tax authority forms part of a series of cyberattacks on French public institutions that has raised questions about the State’s ability to protect citizens’ sensitive data.
In December 2025 the Interior Ministry confirmed that hackers had gained access to email servers and a limited number of confidential files, including elements of criminal records systems. The police records database and the register of wanted persons were both consulted, and a 22-year-old suspect was arrested.
This was followed in February 2026 by the unauthorised consultation of data linked to approximately 1.2 million bank accounts held in the national FICOBA registry, after an attacker used stolen official credentials. The DGFiP has said there is no known link between that case and the latest one.
In April 2026 the National Agency for Secure Titles (ANTS), responsible for identity cards, passports and driving licences, disclosed a breach that exposed personal details from millions of records. The Interior Ministry put the number of accounts concerned at 11.7 million and a 15-year-old was later arrested and charged.
That case prompted Prime Minister Sébastien Lecornu to announce a €200 million cybersecurity plan on April 30, funded from the France 2030 investment programme and paired with proposals for a new State digital authority.
Lecornu said France had been recording about three data thefts a day since the start of 2026.
