Skip to content
France Cyberwatch
enfr

Back to the incidents

31 January 2026

DGFiP / FICOBA

Government Finance / tax

Critical Confirmed

From late January through 13 February 2026, an attacker used credentials belonging to a civil servant outside DGFiP who was authorised to query FICOBA for inter-ministry information exchange. About 1.2 million bank-account records — less than 1 percent of the register — were consulted or extracted.

The 1.2 million figure refers to bank accounts, not unique people. One person can hold more than one account, and one account can have several holders.

Dated facts in the public record

  1. Illegitimate FICOBA consultations begin using the credentials of an authorised civil servant outside DGFiP.

  2. Last day of the illegitimate access window stated in later parliamentary answers.

  3. DGFiP makes its first CNIL notification, according to a later parliamentary response.

  4. Finance Ministry publicly discloses the incident and the approximately 1.2 million-account scope.

  5. DGFiP supplements its CNIL notification.

  6. Banks begin receiving securely transmitted information about their accounts in the consulted set.

  7. Parliamentary answer: the compromised account belonged to another administration, not a FICOBA software exploit.

How it happened

The attack used valid credentials attached to an authorised inter-ministry user outside DGFiP. The government has not published how those credentials were stolen. A parliamentary response states that the incident resulted from use of an account in a third administration and was not the result of a software vulnerability in FICOBA itself.

What was exposed

Bank-account identifiers such as RIB and IBAN, account-holder identity and postal address. The Finance Ministry said the tax identifier was not consulted during the illegitimate access.

What was not in scope

FICOBA does not contain account balances or transaction history. The incident did not compromise bank passwords, impots.gouv.fr passwords or access to taxpayers’ secured tax spaces. An IBAN is sensitive for fraud, but it is not a credential that grants online-banking control.

What it meant in practice

The most credible downstream harms are targeted bank and tax phishing, identity fraud and attempts to create unauthorised direct debits. The combination of a real identity, address and IBAN is especially useful for a fake-bank adviser or administrative impersonation scam.

What was done next

DGFiP restricted external access, worked with ANSSI and ministry security officials, notified the CNIL, filed a complaint, contacted affected users, and provided banks with account-level information so they could strengthen monitoring and customer warnings. Later parliamentary responses say external access remained cut while security work continued.

What later reporting changed

Later parliamentary material confirms the first public account and adds the security-boundary finding: the compromised credentials belonged to a civil servant outside DGFiP, and the incident was not a FICOBA software exploit.

In their words

  • impersonated or used a civil servant’s credentials

    Original usurpé les identifiants d’un fonctionnaire

    French Finance Ministry, 18 February 2026

  • 1.2 million accounts

    Original 1,2 millions de comptes

    French Finance Ministry, 18 February 2026

What does this mean?

Phishing
A message or call that imitates a real organisation to get you to hand over a password, a code or a payment.
IBAN
Your bank account number in international format. Knowing it lets a scammer sound convincing; it does not by itself let them take money.
Credentials
A username and password pair, or the equivalent key an application uses to log in.