Leak at Direction Générale des Finances Publiques

On 18 February 2026, the Direction Générale des Finances Publiques (DGFiP) — France's national tax administration, part of the Ministry of the Economy (Bercy) — disclosed that FICOBA, the Fichier national des comptes bancaires (the central registry listing every bank account opened in France), had been illegitimately accessed.

Starting in late January 2026, an attacker hijacked the credentials of a civil servant who held legitimate access to FICOBA under the inter-ministerial information-sharing arrangements. Using that stolen identity, the intruder queried and extracted data on roughly 1.2 million account holders — less than 1% of the records in the file. The DGFiP detected the intrusion, applied immediate access restrictions to cut it off, and limited the volume of data that could be consulted and exfiltrated.

Exposed data categories included:

• Identity of the account holder
• Postal address
• Bank details (RIB / IBAN)
• Tax identification number (in some cases)

Authorities stressed that the leaked FICOBA data does not reveal account balances and is not by itself sufficient to carry out banking transactions, though it raises the risk of targeted phishing and fraud. The Ministry filed a criminal complaint and notified France's data-protection authority, the CNIL; the Banque de France issued guidance urging affected holders to stay alert to fraud. The intrusion was contained, with affected users to be notified individually and banks alerted to warn their customers.