Hack on France’s Tax Authority Exposes Data of 678,000 Taxpayers

⏱️ Lectura: 12 min

On August 14, 2026, France’s Directorate General of Public Finances (DGFiP) confirmed what had already been circulating on data sale forums for two days: an attacker had stolen a file containing 678,000 taxpayer records, both individuals and businesses. The DGFiP breach was not a sophisticated, cutting-edge attack: it was a compromised VPN account belonging to a tax agency employee, and nobody noticed until the data was already for sale.

📑 En este artículo

1. TL;DR
2. Introduction
3. What happened in the DGFiP breach
4. Context and history
   1. The Bulgarian precedent that changes the rules
5. Technical details and performance
6. How to audit your own remote access today
7. Impact and analysis
8. What’s next
9. Frequently Asked Questions
   1. How much data was leaked in the DGFiP breach?
   2. How did the attacker get into the French tax authority’s system?
   3. Why did it take so long to detect the leak?
   4. What other French institutions were hacked in 2026?
   5. Can a citizen sue the State over this leak?
   6. What technical measures could have prevented or shortened this breach?
10. References

What follows is not just the chronicle of a French incident. It’s a case study in how an organization can cut off an attacker’s access in late June and still not realize the file had already been stolen until August 12, when someone put it up for sale.

TL;DR

• The DGFiP (France’s tax authority) confirmed a leak of 678,000 taxpayer records, detected on August 12, 2026.
• The attacker got in using a tax agency employee’s VPN account; access was cut off in late June, but the exfiltration wasn’t detected until the data went up for sale.
• The leaked data includes name, address, phone number, email, family quotient, reference income, and withholding tax rate.
• The same attacker claimed a second attack, from late July, against the French land registry: more than 2 million people affected.
• France’s National Education system suffered its third hack of the year on July 25-26, 2026, without publishing official figures.
• The Paris Prosecutor’s Office opened an investigation on August 16, led by the Anti-Cybercrime Office.
• Bulgaria 2019 (6 million records) set a precedent: the EU ruled in 2023 that mere fear of misuse already constitutes compensable damage.
• MEP Aurore Lalucq called for the resignation of Public Accounts Minister David Amiel over the slow response.

Introduction

The DGFiP breach adds to a string of incidents against French public institutions in 2026: the land registry, National Education, and before that, the National Secure Document Agency (ANTS). The pattern repeats: compromised professional accounts, months of undetected exfiltration, and announcements that arrive weeks after the fact. For development and security teams in Latin America that handle sensitive user data or build systems for the public sector, the French case is a manual of what not to do with remote access control.

What happened in the DGFiP breach

As confirmed by DGFiP Director General Amélie Verdier on Friday, August 14, the leaked file contains the first and last names, family quotient, reference tax income, and withholding tax rate of 678,000 taxpayers. The sample analyzed by French outlet FrenchBreaches, cited by Cybernetica, adds mailing address, phone number, email address, and number of dependents.

The attacker’s access was cut off in late June, but nobody connected that cutoff to a possible data leak. The exfiltration was only identified when the file appeared for sale on August 12: nearly six weeks after access was cut off, and, according to the timeline the administration itself acknowledged, months after the original intrusion.

Context and history

This is not the first time the French administration has exposed taxpayer data in 2026. The same attacker claimed a second intrusion, from late July, against the professional land registry data server: more than two million people affected, according to their own account. The attacker said they had obtained access through a VPN used by tax agency employees, and added a public comment: they wanted people to wake up to what they literally called a deficient system.

Almost in parallel, on the night of July 25 to 26, someone broke into the staff training information system of France’s National Education using, once again, a hijacked professional account. The exposed data covers all staff who worked at any academy since 2001: identity, status, roles, and for some, address, phone number, and social security number. The ministry didn’t publish volume figures. The announcement came out on July 31, in the middle of vacation season, and went almost unnoticed. It was National Education’s third hack so far in 2026.

Incident	Date	Records exposed	Detection time
DGFiP (tax authority)	August 12, 2026	678,000	~6 weeks after access cutoff
French land registry	Late July 2026	More than 2 million (per the attacker)	Not confirmed
National Education	July 25-26, 2026	Not published	Announcement 5 days later
Bulgarian tax agency	July 15, 2019	6 million	Legal reference in 2023

The Bulgarian precedent that changes the rules

The question that circulated on social media after the DGFiP’s confirmation was direct: can a citizen sue the State for negligence in cybersecurity? The answer already exists, and it comes from Bulgaria. On July 15, 2019, the Bulgarian national revenue agency suffered an intrusion that exposed the tax and social data of six million people. One taxpayer sued her own tax administration.

The Court of Justice of the European Union ruled on December 14, 2023, and set three criteria that also apply in France today, since they interpret the General Data Protection Regulation (GDPR), in force across the whole bloc:

• Fear is enough. The fear of misuse of one’s own data already constitutes compensable damage, without needing to have been the victim of actual fraud.
• The burden of proof is reversed. It is the administration that must prove its security measures were adequate, not the citizen who must prove they weren’t.
• A third-party attack does not exempt liability. The fact that the damage comes from a hacker does not automatically release the public body from its obligation to protect the data.

Technical details and performance

The entry vector in the DGFiP case was, according to the attacker’s own account, a legitimate VPN account used by tax agency employees. There was no zero-day vulnerability exploited or sophisticated malware involved: someone had valid credentials and used them to move within the network until reaching the taxpayer database.

What failed wasn’t the perimeter, it was detection. Access was cut off in late June (likely by revoking the compromised credential), but that cutoff didn’t trigger any alert that the account had already exfiltrated data. It’s the classic pattern of a system with access control but no behavior monitoring: the door gets closed after the attacker has already left, and nobody checks what they took.

A simplified example of the kind of signal that should have triggered an alert: a download volume far above that account’s historical average, during an unusual time window. This can be detected with basic statistics on access logs, without needing a commercial SIEM:

vpn_user,timestamp,bytes_downloaded
agent_fiscal_042,2026-06-18T02:14:00,812000000
agent_fiscal_042,2026-06-18T02:19:00,940000000
agent_fiscal_042,2026-06-18T02:26:00,1050000000

Three downloads of nearly a gigabyte each, in the early morning hours, from an account that normally moves a few megabytes per session, is exactly the kind of anomaly a simple script can flag. A minimal detector in Python, running over that same log, would look like this:

import csv
import statistics

sesiones_por_usuario = {}

with open("vpn_access.csv") as f:
    for fila in csv.DictReader(f):
        usuario = fila["vpn_user"]
        bytes_desc = int(fila["bytes_downloaded"])
        sesiones_por_usuario.setdefault(usuario, []).append(bytes_desc)

for usuario, valores in sesiones_por_usuario.items():
    media = statistics.mean(valores)
    desvio = statistics.pstdev(valores) or 1
    for valor in valores:
        z_score = (valor - media) / desvio
        if z_score > 3:
            print(f"ALERT: {usuario} downloaded {valor} bytes (z={z_score:.1f})")

This doesn’t replace a real threat detection system, but it illustrates the central point: exfiltration detection doesn’t depend on exotic technology, it depends on someone measuring each account’s normal behavior and comparing against it. The DGFiP, according to the timeline it itself acknowledged, either didn’t have that comparison running, or didn’t review it in time.

sequenceDiagram
    participant A as Attacker
    participant V as Tax agency VPN
    participant D as DGFiP database
    participant M as Black market
    A->>V: uses stolen credentials
    V->>D: accesses tax data
    D-->>A: exfiltrates 678000 records
    Note over A,D: access cut off in late June
    A->>M: puts the data up for sale
    Note over V,M: breach detected on August 12

How to audit your own remote access today

If you manage a corporate VPN or a system with remote access to sensitive data, there are concrete steps you can apply this week, without waiting for an incident:

• Require MFA on the VPN. A stolen credential without a second factor is exactly the scenario in the DGFiP case. With WireGuard this is implemented at the authentication proxy level; with OpenVPN, via plugins like openvpn-auth-mfa or integrations with Duo or Authelia.
• Log data volume per session, not just login or logout. The log from the earlier example (user, timestamp, bytes) is the bare minimum needed to detect exfiltration after the fact.
• Alert on revocations without investigation. If you cut off an account’s access due to suspicion, that revocation should automatically trigger a retroactive review of its most recent sessions, not get closed out as a resolved case.

To verify that the anomalous volume alert is actually active (and not just configured in a document), run the detector against a test log with an artificially inflated session and confirm that the ALERT message appears in the output. If nothing appears, the rule isn’t working, no matter what the configuration manual says.

⚠️ Heads up: cutting off a compromised account’s access is not the same as confirming what the attacker took while they had access. These are two distinct steps, and the DGFiP case shows what happens when only the first one is done.

Impact and analysis

The political reaction was immediate. MEP Aurore Lalucq, co-chair of Place Publique, publicly called for the resignation of Public Accounts Minister David Amiel, deeming the government’s response too slow. The Paris Prosecutor’s Office opened an investigation on Saturday, August 16, led by the Anti-Cybercrime Office, and affected taxpayers would only begin being notified individually the following week: nearly two months after the original intrusion.

That gap, weeks between detection and individual notification, is itself a regulatory problem. Under the GDPR, a personal data breach must be reported to the supervisory authority within 72 hours of becoming aware of it, and to affected individuals without undue delay when the risk to their rights is high. A leaked family quotient, reference income, or number of dependents is precisely the kind of data that enables targeted tax fraud and identity theft.

The Bulgarian precedent gives the 678,000 affected individuals a concrete legal avenue in any court of an EU member state: they don’t need to prove they already suffered fraud, it’s enough to demonstrate reasonable fear that it will occur, and it’s the DGFiP that must prove its remote access controls were adequate on the day of the intrusion.

💭 Key point: since December 2023, across the entire European Union, a public body can no longer hide behind the fact that it was an external attack to avoid civil liability for a data leak.

What’s next

The Anti-Cybercrime Office’s investigation still has to determine how the compromised VPN credential was originally obtained: targeted phishing, password reuse, or a third vector not yet confirmed. Individual notification to the 678,000 affected taxpayers, promised for the week of August 17, is the next verifiable public milestone. In parallel, the first French civil lawsuits explicitly relying on the 2023 Bulgarian precedent are expected to appear, given that a proven legal route already exists within the European Union itself.

For development teams building or maintaining government systems or sensitive data platforms in Latin America, where several tax agencies are migrating to digital platforms, the French case is a direct reference for which controls to audit before an incident happens, not after.

📖 Summary on Telegram: View summary

Try it yourself: run a simple query today against your VPN logs to see if any account downloaded a volume of data far above its historical average.

Frequently Asked Questions

How much data was leaked in the DGFiP breach?

A file with 678,000 entries of French taxpayers, both individuals and businesses, confirmed by the DGFiP itself on August 14, 2026.

How did the attacker get into the French tax authority’s system?

According to their own account, by using access from a VPN account used by tax agency employees, without needing to exploit a software vulnerability.

Why did it take so long to detect the leak?

The attacker’s access was cut off in late June, but that didn’t trigger a retroactive review of what data had been downloaded. The leak was only identified when the file appeared for sale on August 12.

What other French institutions were hacked in 2026?

The land registry (more than two million people, according to the attacker) and National Education, which suffered its third incident of the year in late July.

Can a citizen sue the State over this leak?

The Court of Justice of the European Union’s precedent on the 2019 Bulgarian case establishes that fear of data misuse already constitutes compensable damage, and that the burden of proof falls on the administration.

What technical measures could have prevented or shortened this breach?

Mandatory MFA on VPN access, per-session data volume logging, and an automatic retroactive review every time a credential is revoked due to suspected compromise.

References

• Cybernetica: original French-language coverage of the DGFiP breach, with the full timeline of the incident.
• impots.gouv.fr: official website of the French tax administration (DGFiP).
• EUR-Lex: official EU legislation portal, with the text of the GDPR and the case law of the Court of Justice of the EU.
• Wikipedia: general background on the General Data Protection Regulation (GDPR).

📱 Do you like this content? Follow our Telegram channel @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.

Imagen destacada: Foto de Markus Spiske en Unsplash