DGFiP Cyberattack 2026: Inside the Attacker's Mind

You may have received a notification email in the past few days, or seen the news circulating online: the Direction générale des Finances publiques (DGFiP), France's tax administration, confirmed on August 13 that it had been the victim of a hack. A malicious actor had gained illegitimate access to its information system as early as late June, undetected for nearly two months before being claimed on a specialized forum on August 12; two days later, a second claim, this time concerning cadastral data, was added. On August 15, the Paris public prosecutor's office opened an investigation through its cybercrime unit to identify those responsible.

• The intrusion reportedly dates back to June 26, 2026, but it was only made public on August 12, nearly two months later.

• Two data leaks have been claimed by the hacker: one on the tax research tool, the other on the land registry. Bercy's official statement confirms a total of 678,000 individuals and professionals affected, cadastral data included, without endorsing the 2 million property owners figure put forward separately by the hacker.

• The impots.gouv.fr website and personal accounts were not affected. Only internal tools reserved for staff are involved.

• No rare technical flaw here: the initial access relies on identity theft, with a malicious actor using stolen credentials.

According to Bercy, a malicious actor gained illegitimate access to the DGFiP's information system, allowing the consultation and extraction of data belonging to individuals and professionals. Two distinct attacks were actually claimed 48 hours apart, against two different systems, via screenshots posted on specialized forums.

The first of the two attacks to be confirmed by Bercy, and the best documented.

Here, reconstructed from known facts and the hacker's own claims, is the path the attacker reportedly followed: credential theft, VPN connection, progress through the information system, then data extraction before the access was cut off.

The DGFiP's information system is like an office building: some badges only open the reception area, while others, belonging to staff, reach further, into the rooms holding confidential files. Here's the path followed by the attacker:

1. Theft of an agent's credentials: an identity theft, not a technical flaw.

2. Connection to the DGFiP's VPN, normally reserved for staff teleworking.

3. Access to the tax research tool, with no additional check reported at this stage, which suggests, in our analysis, a lack of segmentation between the VPN and this tool.

4. Data extraction over several weeks, starting June 26.

5. As soon as the intrusions were detected, the DGFiP cut off the accesses involved; however, the checks carried out at that point did not establish that these intrusions had led to data theft, due to the sophistication of the attack, according to the official statement of August 14.

6. Claimed on a forum on August 12 by ZeroBytes, a group of two people motivated by money, according to AFP.

7. Confirmed by Bercy the very next day, August 13.

The DGFiP itself described the operation as "more sophisticated than what we had seen in the past": the absence of "mass querying," an unusual volume of requests that the administration more easily detects, partly explains why the extraction went unnoticed for so long.

The official statement of August 14 confirms a total of 678,000 individuals and professionals affected, out of the 678,438 lines the hacker claimed to have extracted. The data confirmed by Bercy includes, for individuals, the reference tax income, family quotient, and withholding tax rate, and for professionals, the company name and SIREN number.

The hacker, for his part, claims to have obtained 678,438 sets of data linked to requests (tickets) from individuals and professionals, containing, according to him, at minimum: first and last name, phone number (sometimes), date and place of birth, email, tax information (sometimes), the name of the agent handling the request, and the subject of the request. This more detailed description has not been confirmed as such by the DGFiP, which has only communicated on the data categories mentioned above.

Back in early 2026, the national bank account registry (FICOBA) had already been accessed fraudulently after an agent's credentials were stolen, exposing 1.2 million bank accounts, according to Journal du Geek. FICOBA only records the existence of an account linked to a person (for example, that a given account holder has an account at a given bank): it contains neither the balance nor any way to set up a direct debit, but it is enough to help set up identity theft or targeted fraudulent canvassing. No code was cracked in that case either: just the right key, obtained elsewhere.

Claimed 48 hours after the first, by the same pseudonym ZeroBytes, targeting a different system.

1. Theft of the identity of an authorized third party, a notary or a licensed surveyor, an authorized user of the Professional Cadastral Data Server, an identity distinct from the one used in the first attack.

2. Bypassing multi-factor authentication (the two-step login verification) to reach this server.

3. Consultation of cadastral data (addresses, property surface areas) starting July 29, without triggering any alert: the connection appeared legitimate, coming from outside.

4. The hacker claims around 252,000 search lines, with a sample of about 1,100 lines provided as proof.

5. Claimed on August 14; access was suspended shortly after publication.

The Paris public prosecutor's office, in opening its investigation on August 15 for fraudulent data extraction and criminal conspiracy, covers both cases; the investigation has been assigned to the Anti-Cybercrime Office (Ofac), part of the national police.

The hacker claims around 252,000 cadastral search lines and mentions, without separate official confirmation, up to 2 million property owners potentially affected, or even 20 million citizens in the system, according to him. Bercy's statement of August 14 confirms the consultation of cadastral data (addresses, property surface areas), but folds it into its overall total of 678,000 people, without assigning it a separate figure.

Three groups are affected, with different risks (what could happen) and impacts (what has already been confirmed).

Phishing remains the main concrete threat for individuals, with messages exploiting the stolen data, up to a fake fraudulent direct debit mandate to approve. For businesses, the concern mostly lies with the DGFiP's own notification obligations to the CNIL (France's data protection authority) under GDPR. For the State, a Surfshark study relayed by Journal du Geek already counted 43.4 million compromised accounts in France in the first half of 2026, in a context where NIS2 is already raising cybersecurity requirements for essential organizations.

At Patrowl, we help organizations identify their exposed access points before an attacker does it for them.

A staff VPN connected directly to a sensitive business tool. That's exactly the kind of blind spot that continuous external attack surface management (EASM) can uncover: mapping what an organization exposes on the internet, identifying what leads to critical systems, and flagging anything out of the ordinary.

These are the principles we apply in our own attack surface management and continuous pentesting tools:

• Continuously map remote access points using EASM solutions.

• Strictly segment assets according to user profiles, so a stolen credential doesn't open the entire information system.

• Deploy strong authentication everywhere, avoiding SMS and email as a second factor.

• Cross-reference technical detections (location, simultaneous connections, timing) with business-level detections (abnormal download volumes) to make alerts more reliable.

This attack vector is nothing new. We've already seen it elsewhere, at comparable or larger scale, which is why it deserves to be addressed at a structural level rather than treated as a one-off incident.

Want to know where your own blind spots are?

Never give out your password, a verification code, or your bank details (account number) following an unsolicited call, text message, or email, even one that looks official, and always verify the identity of whoever you're speaking with before sharing tax or personal information.

Keep an eye on your accounts, on impots.gouv.fr, and with your bank, checking with your bank that no unknown direct debit mandate has been registered.

A legitimate email will never ask for a password, a verification code, bank details, or a card number, and won't contain an executable attachment or a shortened link: if in doubt, don't click on anything and go directly to the official website by typing the address in yourself.

For help:

• cybermalveillance.gouv.fr

• The CNIL's guidance sheet on personal data breaches

• Signal Spam and Pharos (internet-signalement.gouv.fr) to report phishing attempts

• French Ministry of Economy and Finance, official press release, August 14, 2026

• France Info, official announcement and 678,000-person tally

• France Info, opening of an investigation by the Paris public prosecutor's office and breakdown of individuals/professionals

• Journal du Geek, initial claim and the FICOBA precedent

• Journal du Geek, Surfshark study on 43.4 million compromised accounts in France

• Euronews, full official statement, Amélie Verdier's apology, and the prosecutor's investigation

Note on sources: most of the underlying news sources for this article are in French, as this is a story about a French government agency reported primarily by French media.