France : 680,000 Taxpayers Threatened After a Cyberattack Against the DGFiP

France faces a new leak of sensitive data. A hacker claims to have extracted information concerning nearly 678,000 taxpayers following fraudulent access to the DGFiP system. Bercy confirms the intrusion and the data exfiltration, but not this number yet. Individuals and professionals are among the potential victims.

France: DGFiP confirms fraudulent access

The case broke out on August 12 when a cybercriminal using the pseudonym ZeroBytes claimed the hacking of the Public Finances General Directorate. France has already experienced several massive personal data leaks. The hacker claims a total of 678,000 people: 392,867 individual accounts and 285,570 professional accounts. Bercy remains more cautious.

The DGFiP confirms that an illegal access did occur at the end of June. The intrusion allegedly followed the identity theft of a person already having access to the information system. The administration had cut this access during an inspection conducted the same month.

Data could nevertheless be viewed and extracted. The Ministry of Finance is continuing its investigations to precisely identify the people concerned. This is why the 678,000 potential victims remain, for now, a number from the hacker and not the definitive tally from the administration. The distinction matters.

Tax data much more sensitive than just an email

The information presented by ZeroBytes goes well beyond a list of email addresses. The sample shared reportedly includes names, birth dates, addresses, family situations, and numbers of dependents. Real estate data, land registry identifiers, withholding tax rates, and reference tax income are also included.

Some old requests sent to tax services would also appear. This type of database naturally interests scammers. A fake bank advisor or a fake tax agent becomes much more credible once they already know your address, your assets, or your tax situation.

The subject also resonates with the debate on gathering financial information. In July, Bull Bitcoin referred the State Council against the French implementation of DAC8, citing the risk created by large databases linking identity and financial data. The DGFiP plans to inform the affected users individually, specifying the information that may have been viewed or extracted.

ANSSI and the High Official for Defense and Security’s service are also participating in the investigations. The CNIL will receive a notification and the administration plans to file a complaint.

A second leak of 2 million people claimed

ZeroBytes does not stop at the first file. The hacker also claims access to the DGFiP’s Professional Land Data Server. He states having extracted 252,149 lines corresponding to 2,041,778 people.

Names, first names, birth dates and places, addresses, parcel references, and links between owners and properties would be in this second database. DGFiP does not confirm this intrusion at this stage. The hacker also claims to have bypassed multi-factor authentication to obtain this access. Again, the technical conclusions must be awaited before considering this version established.

France thus finds itself with a confirmed cyberattack and a second claim still being verified.The problem goes beyond simple fiscal confidentiality. Information about assets can facilitate very personalized scams and, in some cases, help identify people with significant assets. This risk already exists in crypto, where France strengthened the protection of professionals after 77 violent cases recorded in 2026.