French Tax Agency Breached Twice, ZeroBytes Claims Sale of 678,000 Records
France’s tax authority has begun warning hundreds of thousands of citizens after its systems were compromised twice, granting attackers access to the tax records of individuals and companies alike.
350,000 Citizens Notified, 678,000 Total Affected
The General Directorate of Public Finances (Direction generale des finances publiques) has already contacted more than 350,000 citizens whose information may have fallen into attackers’ hands. The incident affected 678,000 individuals and organizations in total.
Prime Minister Sebastien Lecornu directed France’s National Agency for the Security of Information Systems (ANSSI) to conduct a thorough review of the circumstances and root causes behind the breach. This review will proceed in parallel with the criminal investigation already underway.
The tax agency has also been instructed to individually notify every affected person as quickly as possible, specifying exactly which of their data may have been exposed. Starting the evening of August 18, the agency began sending out the corresponding notification letters.
Elevated Phishing Risk for Affected Taxpayers
The notification letters warn citizens of a heightened risk of phishing attempts and fraudulent phone calls. Attackers may leverage genuine tax data to make their approaches appear considerably more convincing. The tax agency emphasized that it never requests personal data outside its secure online account portal, and advised citizens to regularly monitor their bank account activity for suspicious transactions.
France’s Ministry of Economy and Finance reported that in fewer than 250 cases, attackers managed to access correspondence exchanged between taxpayers and the agency. However, attackers were not able to take action on behalf of account holders in any of these cases.
Two Separate Breaches: Late June and Late July
The tax agency confirmed that its system was breached on two separate occasions – once in late June and again in late July. Beyond the data of at least 678,000 individuals and organizations, attackers also obtained approximately 200,000 records from cadastral (land registry) files.
Among the stolen data were taxpayers’ first and last names, the income figures used to calculate their taxes, family quotient coefficients, and income tax withholding rates.
Criminal Investigation and Accelerated Security Program
The Paris prosecutor’s office has opened an investigation into unlawful data extraction and participation in an organized criminal group. At the same time, the Prime Minister has ordered an acceleration of the government’s information systems protection program, which was originally announced in late April.
ZeroBytes Claims Responsibility
A hacking group calling itself ZeroBytes has claimed responsibility for the data theft. Representatives of the group stated that the stolen data has already been sold, though these claims cannot currently be independently verified. ZeroBytes claims to consist of two hackers identifying themselves as French.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
