France: Tax Authority Laid Bare

Article by Nacata Security, 17/08/2026

Can you imagine someone knowing your tax return without your knowledge?

That just happened to 678,000 French taxpayers.

The French tax authority confirmed that a cyberattack extracted personal data from nearly 700,000 individuals and businesses, in what its officials described as the most sophisticated attack they have ever faced.

The attackers made off with income figures, tax rates, and family status: exactly what you need to make a phishing attempt sound so convincing that anyone could fall for it.

An image illustrating the calculated extraction of personal and tax data: an attacker coldly examining detailed information about the income and family circumstances of thousands of people. — Highly exposed data

The attack was no accident: it was a calculated extraction.

The hackers extracted data from 678,000 users of the French tax system, both individuals and businesses. The DGFiP clarified that the stolen data does not allow access to accounts on the impots.gouv.fr portal, but that does nothing to reduce the real damage. With that information, an attacker can craft phishing messages or phone calls so convincing they are nearly impossible to distinguish from official communications.

They know how much you earn, how many children you have, and what you pay.

That combination is a master key for fraud. If someone calls you claiming to be from the tax authority and mentions your tax bracket and family situation, your brain registers it as legitimate. Providing a password then feels like the natural next step. Authorities asked the DGFiP to notify those affected starting the following Monday, alerting them to the risk of identity theft.

Investigators still do not know who did it or why.

The Paris Prosecutor’s Office opened an investigation and transferred it to OFAC, France’s specialized cybercrime unit. Authorities have not revealed how the attackers gained access or whether the data has already been sold. Minister David Amiel called for urgent proposals to strengthen security.

An image representing the pattern of three French public agencies compromised in rapid succession, suggesting a coordinated campaign rather than isolated attacks. — Confirmed coordinated pattern

This attack is not an isolated incident in France.

Prior to this breach, ANTS, the secure documents agency, and INSEE, the statistical authority, were also compromised within a matter of weeks.

Three public agencies struck in succession point to a deliberate campaign.

Three public agencies compromised within a few weeks expose millions of French citizens to cross-referencing fraud using combined data.

The pattern is clear and no one denies it.

When three government agencies fall in rapid succession, the question is no longer whether there was coordination, but who is behind it and what they will do with everything collected — a second layer of the problem that extends well beyond France.

Stolen data is worth more than it appears.

Breaches at public agencies are especially dangerous because tax information is extremely stable: your tax identification number, your address, and your income do not change every month like a password. The stolen data will remain useful to attackers for years, long after the incident fades from the headlines and people let their guard down.

For the businesses affected, the risk is equally real.

Although authorities described the business data as less sensitive, SIREN registration numbers, business addresses, and authorized representative details are sufficient to impersonate a company before suppliers or banking institutions. Corporate fraud based on verified data is a threat that many organizations underestimate.

An image illustrating the lasting damage caused by breaches at public agencies: stable data such as tax records that remain useful to attackers for years. — Perpetually useful data

Any contact you receive about this breach is suspicious.

Authorities will notify those affected, but that creates a perfect window for attackers to send fraudulent messages impersonating the tax authority. If you receive anything related to this incident, do not click any links or provide any information.

Direct verification is your only defense.

If you are contacted about this breach, access the official portal yourself without using the link provided. Call the official number if you have any doubts. No legitimate communication will ask for your password or full banking details, regardless of how official the call or message sounds.

Knowing more does not make you more vulnerable.

Understanding how post-breach fraud works is the best way to avoid falling for it — and that is exactly the question you should be asking yourself right now.

What you can do

✓Always access the official portal without using links received by message.
✓Be wary of any call that asks for passwords or banking details.
✓Enable transaction alerts on your bank account to detect fraud.

Would you be able to tell a real tax authority call from a fraudulent one?

Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.

France: Tax Authority Laid Bare

France: Tax Authority Laid Bare

What you can do

Related articles

We are Nacata Security, get to know us