Loading story…
France’s Ministry of the Economy and Finance confirmed a cyber intrusion into the Direction générale des Finances publiques (DGFiP) that exposed data linked to roughly 680,000 individuals and businesses after unauthorized access in late June 2026. Reporting indicates the compromise involved impersonation or misuse of identity and access privileges, with at least 678,437 affected records later advertised for sale on the dark web by an actor calling itself ZeroBytes. The exposed population reportedly included both private taxpayers and professionals, and the intrusion was detected during a routine check before access restrictions were tightened.
Separate dark-web reporting tied to the same actor alleges a broader compromise of DGFiP-linked cadastral systems affecting 2,041,778 property holders, including land-registry data associating named individuals with fixed addresses and ownership information. Those claims say the attackers used valid credentials and an alleged multi-factor authentication bypass, and that they offered both the stolen data and continued access for sale, although that second breach had not been publicly verified or acknowledged by DGFiP at the time of reporting. The incident raises immediate risk of phishing, business email fraud, and other social-engineering attacks using tax, cadastral, and civil-status data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
On 13 August 2026, a second ZeroBytes claim was observed alleging compromise of DGFiP's professional cadastral data server and offering both extracted data and ongoing access for sale. The report said the claim was unverified and that the actor asserted access was still active.
On 12 August 2026, a listing was observed in which ZeroBytes claimed to be selling a partial database of 678,438 French taxpayer records allegedly taken from the tax administration. The report said the claim was unverified and that a sample of 1,126 records was said to be publicly hosted.
ZeroBytes claimed it breached DGFiP's professional cadastral data server on 29 July 2026, extracting 252,149 rows said to cover 2,041,778 individuals. The actor said access used valid credentials with a multi-factor authentication bypass and did not require a VPN.
A dataset allegedly taken from the French tax administration was described as containing 678,438 taxpayer records dated June 2026. The claim said the actors accessed internal taxpayer search tools using VPN credentials obtained from internal servers before being disconnected.
The French Ministry of the Economy and Finance said unauthorized access to the DGFiP information system occurred in late June 2026 through identity impersonation and abuse of access privileges, allowing consultation and extraction of sensitive data on individuals and companies.
France’s Ministry of National Education published a notice about a security incident affecting the data of certain students. This is a separate incident from the DGFiP breach and identifies a new affected public-sector victim.
A crisis meeting involving multiple ministries was convened by Prime Minister Sébastien Lecornu in response to the DGFiP intrusion. The move marked an escalation of the French government's response beyond DGFiP's public statement and the prosecutor's investigation.
French authorities opened a criminal investigation into the DGFiP breach through the Paris Public Prosecutor’s cybercrime unit and assigned the case to OFAC, France’s cybercrime office. The move followed confirmation that data on about 678,000 taxpayers had been exposed.
DGFiP said individuals whose data was compromised would be contacted directly, France’s data protection authority would be notified, and a criminal complaint would be filed over the breach. The statement was made as the agency responded publicly to the incident.
The French Ministry of the Economy and Finance publicly confirmed a cyberattack affecting DGFiP, with data tied to roughly 680,000 individuals and businesses exposed and later offered for sale on the dark web. Reporting also noted the attacker had claimed a second exfiltration involving nearly two million land and property owners.
According to the Ministry of the Economy and Finance, the illegitimate access was discovered during a routine check and immediately cut off. DGFiP then implemented new restriction measures to stop the access and prevent further unauthorized use, while ANSSI and SHFDS were mobilized.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
19 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourcehelpnetsecurity.com
Open sourcesecurityweek.com
Open sourceheise.de
Open sourcedarkwebinformer.com
Open sourcepresse.economie.gouv.fr
Open sourcedarkwebinformer.com
Open sourceeducation.gouv.fr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
France’s Ministry of the Economy and Finance confirmed that an attacker **accessed and consulted data tied to ~1.2 million French bank accounts** by using **stolen login credentials** belonging to an authorized government user of the national bank account registry (*FICOBA*). The intrusion began in **late January 2026** and exposed account-linked personal data including **IBANs**, account holder **names**, **addresses**, and in some cases **tax identification numbers** (DGFiP-issued). Authorities stated the access did **not** enable viewing balances or initiating transactions. After detection, the ministry reported it **blocked the attacker**, notified France’s data protection authority (**CNIL**), and **filed a criminal complaint**; impacted individuals are expected to be contacted directly, and **banks were alerted** to advise customers to remain vigilant. Reporting noted the incident follows other recent cyber disruptions affecting French public services (including attacks impacting **La Poste/La Banque Postale** and the **Interior Ministry**), though no motive or attribution for the FICOBA access has been publicly confirmed.
Jun 29, 2026
France Titres, the French agency formerly known as ANTS and responsible for identity and registration documents, confirmed a breach of its `ants.gouv.fr` portal after threat actor **breach3d** advertised a trove of stolen records for sale on cybercrime forums. The agency said the compromised data may include login IDs, full names, email addresses, dates and places of birth, account identifiers, and in some cases postal addresses and phone numbers from both individual and professional accounts. Other reporting on the sale listings said the dataset could contain 18 million to 19 million records, including fields indicating government-verified identities, raising the risk of phishing, social engineering, and identity fraud if the claims are fully accurate. French authorities said unusual activity was identified in mid-April and launched parallel technical and judicial investigations involving **ANSSI**, **CNIL**, the Paris Public Prosecutor, and anti-cybercrime investigators. Prosecutors later announced the arrest of a 15-year-old suspect in connection with the case after records linked to the agency were allegedly offered for sale online, and said the inquiry covers unauthorized access, persistence, and extraction of personal data from a state-operated system. France Titres has notified affected individuals and said the stolen information does not provide direct access to user accounts or the portal itself, while warning citizens to remain alert for follow-on scams and impersonation attempts.
Jun 29, 2026
French authorities confirmed unauthorized access to **FICOBA**, the national registry of bank accounts, after an attacker used **stolen credentials belonging to a government official** to view records tied to roughly **1.2 million** accounts. Exposed data reportedly included account numbers and account-holder identity details (names, addresses, and in some cases tax identification numbers), while **balances and transaction histories were not accessed**; officials said the access was detected and blocked quickly and that affected individuals would be notified. A criminal complaint was filed and the incident was reported to **CNIL** (France’s data protection authority). Reporting also indicated the government described the incident as involving data “stolen” from the repository, though other accounts emphasized that access was interrupted before exfiltration could occur, leaving the precise extent of data removal unclear. The incident highlights the risk of credential compromise for privileged government access to sensitive financial registries and the downstream exposure of identity-linked banking metadata that can enable targeted fraud and social engineering even without transaction data.
Jun 29, 2026