DGFiP taxpayer data breach (August 2026)

On 14 August 2026, France's tax authority — the Direction Générale des Finances Publiques (DGFiP) — confirmed that attackers had breached its information systems and stolen data belonging to roughly 678,000 taxpayers. The authority disclosed the incident after a threat actor advertised a stolen database for sale on a hacking forum.

What happened

According to DGFiP, the intrusion relied on stolen or impersonated credentials belonging to a DGFiP employee and an authorised third party. The unauthorised access took place during June and July 2026. The breach came to light after a threat actor using the handle "ZeroBytes" claimed the attack and, on 12 August, listed the stolen database for sale on the PwnForums forum, touting a far larger record count than DGFiP ultimately confirmed. The authority issued a press release confirming the breach on 14 August.

The stolen data covered approximately 390,000 individuals and 285,000 businesses and included names, dates of birth, addresses and land-registry information, along with tax details such as reference tax income, family-quotient information and withholding-tax rates.

Crucially, DGFiP stressed that taxpayers' online "Finances publiques" accounts were not compromised, and that personal and business usernames and passwords were not exposed in the incident.

Impact

• Personal and tax data for about 678,000 individuals and businesses was stolen.
• Exposed fields — identity, address, land-registry and income data — create meaningful fraud and identity-theft risk, and a strong basis for tax-themed phishing against French taxpayers.
• Online tax accounts and credentials were reported unaffected, limiting the risk of direct account takeover.

Why it matters

The DGFiP breach is a reminder that credential compromise of trusted insiders and third parties — not a headline software exploit — is often enough to reach a government's most sensitive citizen data. It is also the second significant incident to strike France's tax administration in 2026, following an earlier breach of the FICOBA bank-account registry, underscoring the persistent targeting of national tax systems. For a public body holding identity, property and income records on essentially the entire adult population, even a breach limited to descriptive data hands criminals precisely the details needed to make impersonation and tax-fraud lures convincing.