In June and July 2026, threat actors gained unauthorized access to the French tax authority DGFiP's internal systems using compromised credentials belonging to an employee and a third-party account. The attackers exfiltrated sensitive tax-related information of approximately 678,000 users, including reference tax income, withholding tax rates, company names, unique identifiers, and cadastral data related to real estate addresses and surfaces. The breach was publicly disclosed after the attacker boasted on a hacking forum. DGFiP promptly suspended unauthorized access upon detection and reported the incident to CNIL. The agency continues to investigate the breach's full extent and is contacting affected individuals. No evidence was found that usernames or passwords were compromised in the attack.

The breach exposed sensitive tax-related data of about 680,000 individuals, including financial and cadastral information. This could lead to privacy violations and potential misuse of personal and corporate tax data. However, no credentials such as usernames or passwords were compromised, which limits the risk of further unauthorized access using stolen login information. The breach may undermine public trust in the tax authority's data security and could have regulatory consequences given the involvement of CNIL.

The French tax authority DGFiP has suspended unauthorized access and reported the breach to the national data protection authority CNIL. They are actively investigating the incident and contacting affected individuals directly. No additional mitigation actions are specified by the vendor at this time. Organizations should monitor official communications from DGFiP and CNIL for updates and guidance.