An attacker accessed the French General Directorate of Public Finances (DGFiP) systems and extracted sensitive tax and cadastral data belonging to 678,000 individuals and professionals. The stolen data includes tax income references, family quotient, withholding tax rates, company names, SIREN numbers, and property-related cadastral data. The attacker, known as "ZeroBytes," posted the stolen database for sale on the PwnForums hacking forum. The breach was discovered after this public claim, leading to system access shutdown and notification to the French Data Protection Authority (CNIL). The attacker also claimed access to the Serveur Professionnel de Données Cadastrales (SPDC), a platform with data on about 20 million citizens, but only partially extracted data on over 2 million people. The French Finance Ministry is contacting affected individuals with details and precautionary advice. No user credentials were compromised, and online accounts remain secure. This incident follows other recent breaches affecting French government agencies.

Sensitive personal and professional tax data and cadastral property information of 678,000 individuals were accessed and stolen. This exposure could lead to privacy violations and potential misuse of tax and property data. However, user credentials and online accounts were not compromised, reducing the risk of direct account takeover. The breach affects individuals and businesses, exposing identifiers such as company names and SIREN numbers. The incident contributes to a pattern of recent cyberattacks on French government agencies, indicating ongoing threats to public sector data security.

The French tax administration has already shut down access to sensitive information systems and is investigating the incident with the National Cybersecurity Agency of France (ANSSI). The French Data Protection Authority (CNIL) has been notified. The French Finance Ministry will contact all affected individuals with information on the data accessed and recommended precautions. No further immediate action is required from users regarding account security since user IDs and passwords were not compromised. Organizations should monitor official communications for updates and follow any guidance provided by the French authorities.