France DGFiP Breach: 678,000 People and Businesses Affected
France's tax authority says unauthorized access to its information systems exposed data concerning 678,000 individuals and businesses. The Ministry of Economy and Finance says the June and July intrusions relied on the impersonation of identifiers belonging to a DGFiP employee and an authorized third party. The exposed information included tax and cadastral data, but the authority says taxpayers' online accounts, usernames and passwords were not compromised.
This incident is particularly useful for security teams because it connects three controls that are often reviewed separately: privileged identity, supplier access and data-exfiltration detection. DGFiP disabled the accounts used in the incidents when the intrusions were found, yet says the access checks performed at that time did not detect the earlier data theft.
What the French government confirms
In an August 14 press release, the ministry said a malicious actor claimed responsibility on August 12 and 13 for access that occurred during June and July 2026. The incidents used impersonated identifiers associated with one DGFiP agent and one authorized third party. When the intrusions were detected, DGFiP cut access for all accounts known to be involved.
Investigations begun after the public claims established that data had been viewed and extracted before the accounts were disabled. The government's current total is 678,000 individuals and professionals. It lists reference taxable income, family quotient and withholding-tax rate among the affected personal data, together with company names and SIREN identifiers for businesses. Cadastral information about addresses and property surface areas was also accessed.
DGFiP says it notified France's data-protection authority, CNIL, introduced additional security measures and is working with the ministry's security service and ANSSI. The authority plans to contact affected people and businesses individually with the categories of data that may have been viewed or extracted and the precautions relevant to them.
What is not confirmed
“Impersonation of identifiers” does not establish how the actor obtained or used them. The public statement does not confirm phishing, malware, password reuse, a multi-factor authentication bypass, a supplier compromise or a particular remote-access product. Those possibilities should remain hypotheses until DGFiP or another authoritative investigation publishes evidence.
Early reporting repeated an attacker's claim of data on more than 600,000 people and, in some cases, much larger totals. Those figures were claims, not confirmed victim counts. The August 14 government release now supplies a confirmed total of 678,000 affected individuals and businesses, while warning that investigations continue into the exact nature and volume of extracted data.
The detection gap matters as much as the identity failure
Disabling a misused account stops future access; it does not answer what the account already viewed, queried or exported. DGFiP says its initial controls did not detect the theft because of the sophistication of the attack. That leaves a practical lesson for any organization with privileged or third-party access: identity alerts and data-access telemetry must be investigated together.
- Preserve authentication, session, query, export and network logs before disabling or rebuilding an account.
- Trace every role, API token, service account and delegated permission reachable from the impersonated identity.
- Review unusual data volume, enumeration patterns, off-hours access and exports—not only failed logins.
- Revoke active sessions and rotate associated secrets from a trusted administrative endpoint.
- Determine whether the third party still needs the same scope, duration and route of access.
- Notify affected people using a channel that does not ask them to disclose credentials or payment details.
Design third-party access for containment
A supplier or partner should not inherit permanent access simply because it performs a recurring task. Prefer named identities, phishing-resistant authentication where supported, just-in-time elevation and narrow permissions tied to the specific workflow. Separate approval from use so one person cannot silently grant and exercise high-impact access without an independent record.
When a human must transfer an initial password, recovery value or temporary token, keep the value out of the ticket, email thread and incident-room chat. Verify the recipient through a separate channel, give the credential the minimum scope and lifetime, and rotate it after onboarding or emergency use. That reduces the number of reusable copies without replacing the identity provider, audit trail or access review.
Where Secretus fits—and where it does not
Secretus can support a one-time handoff of a temporary administrative credential or recovery code between already authorized people. Standard Mode can reduce persistent plaintext copies, while Team Split can support a pre-planned multi-person release for a high-impact recovery secret.
Secretus cannot detect identity impersonation, enforce least privilege, inspect tax-data exports or make a compromised endpoint trustworthy. It should not be used to move taxpayer records outside their governed systems. The appropriate role is narrow: protect the secret used during an authorized handoff, then rely on IAM, monitoring and rotation to control what happens before and after the value is revealed.
This is separate from the February FICOBA incident
DGFiP disclosed a different incident in February 2026 involving unauthorized access to France's national bank-account register, FICOBA. The current disclosure concerns June and July access to DGFiP systems and a different confirmed population and data set. Combining the two events would produce an inaccurate victim count and obscure the response actions required for each breach.
What remains unknown
The government has not disclosed how the identifiers were obtained, which technical access path was used, how long each unauthorized session lasted, whether all extracted fields have been identified or whether the confirmed total will change. It has not publicly attributed the incident to a named actor. Affected users should rely on DGFiP's individual notice and verify unexpected tax-related messages through official channels rather than replying to an unsolicited sender.