The French Federal Revenue Service (DGFiP) officially recognized, on August 14, 2026, that it suffered a cyber attack that allowed attackers to access its systems and extract data in June of the same year. The admission came after an alleged digital criminal released a database that he said contained information on two million taxpayers.
An individual using the pseudonym “ZeroBytes” was responsible for announcing the stolen database on a cybercrime forum on August 12, 2026. The claim was that the records belonged to more than two million French citizens.
According to information released by “ZeroBytes”, access to DGFiP systems was obtained through credentials that had been stolen, in addition to a technique that bypassed multi-factor authentication (MFA).
The cybercriminal also stated that he maintained continuous access to the French IRS systems and proposed the sale of these credentials together with the database obtained.
Initially, DGFiP did not comment on the attacker’s statements. However, in a statement released on August 13, 2026, the authority disputed the claim that “ZeroBytes” had maintained prolonged access to the systems.
The official statement from the French Federal Revenue Service detailed what happened: “On Wednesday, August 12, 2026, a malicious actor claimed unauthorized access to the information system of the French Public Finance Directorate, which occurred at the end of June 2026 following an identity theft.”
The statement continued, confirming the preliminary investigations: “Initial investigations confirm that this access, which had been interrupted at the end of June as part of an audit, nevertheless allowed the consultation and extraction of data relating to individuals and professionals.”
DGFiP also reported the actions taken in response to the complaint. “Following this report, France’s General Directorate of Public Finance immediately implemented new restrictions to prevent unauthorized access and prevent further misuse. In-depth investigations are underway to determine precisely what data and how many users were affected.”
The French authority also stated that it will notify the CNIL, the body responsible for data protection in the country, about the incident and that the affected users will be notified as soon as they are identified.
The recent invasion at the French IRS represents the latest episode in a series of security breaches that have affected public bodies in France throughout the year.
Growth of digital attacks against the French public sector
The French Ministry of Finance, responsible for supervising the DGFiP, had already revealed in February that criminals accessed a database with French citizens’ banking information. In this incident, the attackers used stolen credentials and took 1.2 million records, even with the ministry quickly revoking access.
A few weeks later, the French Ministry of Health confirmed a cyber attack on Cegedim Santé, a healthcare technology provider. The attack resulted in the theft of approximately 15.8 million administrative files. Of these, around 165,000 documents contained medical notes, including, in “very limited cases”, patients’ health histories.
In April, the Interior Ministry validated reports of an offensive against France Titres, the government agency in charge of issuing identity documents such as passports and driver’s licenses. The person allegedly responsible for the attack, a 15-year-old boy, allegedly published the data on the internet and claimed that the breach affected between 18 and 19 million people, which represents more than a quarter of the population of metropolitan France.
In June, the department of Tchap, the French government’s encrypted messaging platform, began an investigation into a possible security flaw. The alleged attackers claimed to have gained access to more than 73,000 user accounts, 643,000 messages, around 60,000 media files and hundreds of chat rooms.
