{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en"},"incident":{"id":"dgfip","date":"2026-08-14","year":2026,"org":"DGFiP tax systems","domain":"economie.gouv.fr","kind":"government","sector":"Finance / tax","sectorLabel":"Finance / tax","severity":"critical","status":"confirmed","affected":678000,"affectedLabel":"678,000 individuals and businesses","data":"Tax data including reference income, household quotient and withholding rate; business name/SIREN. Cadastral data also consulted. User tax-space passwords not compromised.","method":"Stolen credentials of a DGFiP agent and an authorised third party.","risk":"Highly persuasive tax and wealth-targeted scams using real fiscal circumstances.","confidence":"Official government disclosure; investigation ongoing","sourceName":"French Finance Ministry","sourceId":"dgfip","sourceUrl":"https://presse.economie.gouv.fr/acces-illegitime-au-systeme-dinformation-de-la-direction-generale-des-finances-publiques/","sourceIds":["dgfip","dgfipLemonde","dgfipBriefing","dgfipEntrevue"],"lastResearched":"2026-08-16","url":"/incident/dgfip","detail":{"lead":"The DGFiP confirmed on 14 August 2026 that two illegitimate-access incidents in June and July had relied on stolen or impersonated credentials belonging to a DGFiP agent and an authorised third party. When the intrusions were detected, access to the implicated accounts was cut. At that time, however, the access-control review did not identify that data had already been stolen.\n\nThe decisive trigger came on 12 and 13 August, when a malicious actor publicly claimed the intrusions. DGFiP then matched the claims against its logs and established that data concerning a total of 678,000 individuals and businesses had been consulted and extracted before access was terminated.","timeline":[{"date":"2026-06-30","label":"A DGFiP agent account is compromised or impersonated (late June). Access is detected and cut. Data theft is not identified at that moment."},{"date":"2026-07-15","label":"A second illegitimate-access incident occurs in July using credentials of an authorised third party, according to the Finance Ministry’s later statement (exact day not published)."},{"date":"2026-08-12","label":"A malicious actor publicly claims access. DGFiP begins deeper investigation against historical logs."},{"date":"2026-08-13","label":"A further claim or disclosure is made by the malicious actor."},{"date":"2026-08-14","label":"Finance Ministry confirms 678,000 individuals and businesses in the established extracted or consulted scope. User tax-space credentials are said to be unaffected."},{"date":"2026-08-16","label":"French reporting says the Paris prosecutor’s cyber section has opened an investigation and entrusted it to OFAC."},{"date":"2026-08-17","label":"DGFiP plans to contact each affected individual or business from the week of 17 August, with details of the data that may have been consulted or extracted."}],"how":"The official account says the incidents rested on credential impersonation: one DGFiP agent and one authorised third party. The Finance Ministry has not publicly supplied the complete authentication architecture or confirmed the attacker’s claims about specific remote-access products. DGFiP said the theft was missed during the initial response because the attack was sophisticated. Press reporting based on a briefing by director-general Amélie Verdier adds that extraction was slow or broken into patterns that did not look like obvious bulk querying.","taken":"The written government statement sets the confirmed combined scope at 678,000 individuals and businesses. It lists reference taxable income, household quotient, withholding-tax rate, business name and SIREN, plus cadastral information relating to addresses and property surface areas.\n\nPress briefing coverage separately reported a cadastral consultation involving around 200,000 accounts. The 14 August written release does not establish that as a second additive victim population, so it is not added to the 678,000.","notTaken":"The Finance Ministry said individual and business Finances publiques spaces were not compromised and that user identifiers and passwords for those spaces were not compromised. Stolen tax data can make fraud extremely convincing, but it does not itself provide a login to a taxpayer’s secured account.","impact":"This is one of the highest-risk identity datasets in the collection because it reveals both personal identity and financial circumstances. A scammer who knows a victim’s reference income, household quotient and withholding rate can convincingly impersonate the tax authority, a bank, accountant or wealth-management service. For high-income households, disclosure may also create targeting and physical-security concerns that go beyond ordinary email phishing.","response":"DGFiP cut access associated with the compromised accounts, then made additional preventive cuts to sensitive information systems after the August discoveries. It notified the CNIL, worked with SHFDS and ANSSI, planned individual notification, and announced a criminal complaint. Reporting on 16 August said a Paris prosecutor investigation had been opened with OFAC.","methodDisclosure":"disclosed","revision":"This case was still evolving at the research cutoff. Criminal posts described a VPN and made additional claims about bypassing authentication controls; those claims remain separate from the official method. The written release also says the exact nature and volume of extracted data and the final number of users concerned were still being investigated, so even the 678,000 figure should be understood as the established scope at 14 August, not necessarily the final endpoint of the inquiry.","quotes":[{"text":"a total of 678,000 individuals and businesses","original":"un total de 678 000 particuliers et professionnels","originalLang":"fr","attribution":"French Finance Ministry, 14 August 2026","sourceId":"dgfip"},{"text":"were not compromised","original":"n’ont pas été compromis","originalLang":"fr","attribution":"French Finance Ministry, 14 August 2026, referring to users’ secured tax spaces and credentials","sourceId":"dgfip"}]}},"source":{"id":"dgfip","name":"French Finance Ministry - DGFiP illegal access","url":"https://presse.economie.gouv.fr/acces-illegitime-au-systeme-dinformation-de-la-direction-generale-des-finances-publiques/","publisher":"Ministry of Finance","kind":"primary","published":"2026-08-14"},"sources":[{"id":"dgfip","name":"French Finance Ministry - DGFiP illegal access","url":"https://presse.economie.gouv.fr/acces-illegitime-au-systeme-dinformation-de-la-direction-generale-des-finances-publiques/","publisher":"Ministry of Finance","kind":"primary","published":"2026-08-14"},{"id":"dgfipLemonde","name":"Le Monde — French taxpayers’ data stolen","url":"https://www.lemonde.fr/en/pixels/article/2026/08/14/french-taxpayers-data-stolen-in-hack-of-finance-ministry_6756510_13.html","publisher":"Le Monde","kind":"secondary","published":"2026-08-14"},{"id":"dgfipBriefing","name":"Le Figaro — DGFiP briefing on the 678,000-account intrusion","url":"https://www.lefigaro.fr/conjoncture/piratage-de-l-administration-fiscale-la-dgfip-revele-les-contours-du-vol-de-donnees-de-678-000-comptes-20260814","publisher":"Le Figaro","kind":"secondary","published":"2026-08-14"},{"id":"dgfipEntrevue","name":"Entrevue — Paris prosecutor opens an inquiry","url":"https://entrevue.fr/societe/piratage-du-fisc-le-parquet-de-paris-ouvre-une-enquete-sur-678-000-victimes/","publisher":"Entrevue","kind":"secondary","published":"2026-08-16"}]}