14 August 2026
DGFiP tax systems
Government Finance / tax
The DGFiP confirmed on 14 August 2026 that two illegitimate-access incidents in June and July had relied on stolen or impersonated credentials belonging to a DGFiP agent and an authorised third party. When the intrusions were detected, access to the implicated accounts was cut. At that time, however, the access-control review did not identify that data had already been stolen.
The decisive trigger came on 12 and 13 August, when a malicious actor publicly claimed the intrusions. DGFiP then matched the claims against its logs and established that data concerning a total of 678,000 individuals and businesses had been consulted and extracted before access was terminated.
Dated facts in the public record
A DGFiP agent account is compromised or impersonated (late June). Access is detected and cut. Data theft is not identified at that moment.
A second illegitimate-access incident occurs in July using credentials of an authorised third party, according to the Finance Ministry’s later statement (exact day not published).
A malicious actor publicly claims access. DGFiP begins deeper investigation against historical logs.
A further claim or disclosure is made by the malicious actor.
Finance Ministry confirms 678,000 individuals and businesses in the established extracted or consulted scope. User tax-space credentials are said to be unaffected.
French reporting says the Paris prosecutor’s cyber section has opened an investigation and entrusted it to OFAC.
DGFiP plans to contact each affected individual or business from the week of 17 August, with details of the data that may have been consulted or extracted.
How it happened
The official account says the incidents rested on credential impersonation: one DGFiP agent and one authorised third party. The Finance Ministry has not publicly supplied the complete authentication architecture or confirmed the attacker’s claims about specific remote-access products. DGFiP said the theft was missed during the initial response because the attack was sophisticated. Press reporting based on a briefing by director-general Amélie Verdier adds that extraction was slow or broken into patterns that did not look like obvious bulk querying.
What was exposed
The written government statement sets the confirmed combined scope at 678,000 individuals and businesses. It lists reference taxable income, household quotient, withholding-tax rate, business name and SIREN, plus cadastral information relating to addresses and property surface areas.
Press briefing coverage separately reported a cadastral consultation involving around 200,000 accounts. The 14 August written release does not establish that as a second additive victim population, so it is not added to the 678,000.
What was not in scope
The Finance Ministry said individual and business Finances publiques spaces were not compromised and that user identifiers and passwords for those spaces were not compromised. Stolen tax data can make fraud extremely convincing, but it does not itself provide a login to a taxpayer’s secured account.
What it meant in practice
This is one of the highest-risk identity datasets in the collection because it reveals both personal identity and financial circumstances. A scammer who knows a victim’s reference income, household quotient and withholding rate can convincingly impersonate the tax authority, a bank, accountant or wealth-management service. For high-income households, disclosure may also create targeting and physical-security concerns that go beyond ordinary email phishing.
What was done next
DGFiP cut access associated with the compromised accounts, then made additional preventive cuts to sensitive information systems after the August discoveries. It notified the CNIL, worked with SHFDS and ANSSI, planned individual notification, and announced a criminal complaint. Reporting on 16 August said a Paris prosecutor investigation had been opened with OFAC.
What later reporting changed
This case was still evolving at the research cutoff. Criminal posts described a VPN and made additional claims about bypassing authentication controls; those claims remain separate from the official method. The written release also says the exact nature and volume of extracted data and the final number of users concerned were still being investigated, so even the 678,000 figure should be understood as the established scope at 14 August, not necessarily the final endpoint of the inquiry.
In their words
a total of 678,000 individuals and businesses
Original un total de 678 000 particuliers et professionnels
French Finance Ministry, 14 August 2026
were not compromised
Original n’ont pas été compromis
French Finance Ministry, 14 August 2026, referring to users’ secured tax spaces and credentials
What does this mean?
- Phishing
- A message or call that imitates a real organisation to get you to hand over a password, a code or a payment.
- Credentials
- A username and password pair, or the equivalent key an application uses to log in.
- VPN
- A private tunnel onto an organisation’s network, often used so staff can work from outside the office.