A DGFiP cyberattack has exposed sensitive tax and cadastral information after attackers allegedly used stolen credentials to access systems belonging to France’s Directorate General of Public Finances. The French Public Finances Directorate said investigations found that data linked to 678,000 individuals and professionals had been consulted and extracted during intrusions in June and July 2026.
The DGFiP cyberattack incidents were identified after a malicious actor claimed illegitimate access to the French tax authority’s information system on August 12 and 13. DGFiP said the intrusions involved the usurpation of identifiers belonging to a DGFiP agent and an authorized third party.
DGFiP Cyberattack Exposed Taxpayer Information
After detecting the intrusions, DGFiP immediately suspended access to the accounts involved. Initial access controls did not identify data theft, which the authority attributed to the sophistication of the attack.
A subsequent investigation established that the compromised access points had been used to consult and extract information concerning 678,000 individuals and professionals.
The exposed information included reference tax income, family quotient and withholding tax rate for individuals. For businesses, the accessed information included company names and SIREN numbers. Cadastral data, including addresses and property sizes, was also accessed.
DGFiP said online accounts belonging to individual and professional users were not compromised, and user IDs and passwords were not affected.
The authority notified France’s data protection regulator, CNIL, after identifying the data breaches.
Cadastral Data Leak Claim Targets DGFiP
Separately, a hacker using the alias ZeroBytes claimed an attack against DGFiP’s Professional Cadastral Data Server (SPDC).
According to the claim cited by FrenchBreaches, the alleged extraction contains 252,149 lines of data representing 2,041,778 people, with multiple holders potentially associated with the same property plot.
The claimed dataset reportedly includes names, surnames, sex, dates and places of birth, addresses, land identifiers, cadastral sections and parcel numbers, as well as information about rights held on properties.
The claim would therefore link individuals to personal information and real estate assets.
However, the figures and technical details in this second claim remain allegations by the cybercriminal. The claim that the system could contain information relating to approximately 20 million citizens is also an estimate made by ZeroBytes and does not establish that this number of people was affected.
Investigation Into French Tax Authority Attack Continues
DGFiP said additional security measures were implemented after investigators uncovered new information. These included preventative shutdowns of access to sensitive information systems.
Investigations remain underway to determine the precise nature and volume of data extracted and the number of users affected.
DGFiP teams are working with France’s economic and financial ministries, the High Official for Defence and Security and the National Agency for Information Systems Security, ANSSI.
The authority said it will contact affected individuals and professionals directly from the following week by email or letter. Those notifications will identify the information that may have been accessed or extracted and outline any precautionary measures where applicable.
DGFiP also said it will file a complaint and provide further information as the investigation progresses.
The separate cadastral data breach claim remains subject to confirmation, including the alleged number of affected people, duration of access, methods used to bypass authentication, the full scope of extracted information and whether access remained active when the claim was published.
The confirmed DGFiP investigation and the separate ZeroBytes claim therefore present different sets of figures and allegations, with the full scope of the incidents still being determined.
