French tax authority breach exposes data on 678,000 taxpayers and businesses

France’s tax administration has confirmed that an attacker extracted data on 678,000 individuals and businesses from its systems. The Direction générale des Finances publiques, the DGFiP, set out the findings in a statement on 13 August 2026 after investigations that began the previous day.

The stolen material includes reference taxable income, family quotient and withholding tax rate for individuals, and company names and SIREN numbers for businesses. Land registry data covering property addresses and surface areas was also accessed. The DGFiP said online accounts were not compromised and that login credentials and passwords were not exposed. It notified CNIL, France’s data protection authority, and took preventive shutdowns of access to sensitive information systems while ANSSI, the national cybersecurity agency, assisted with the assessment.

How it came to light

The incident surfaced publicly through the attacker rather than the ministry. A threat actor using the handle “ZeroBytes” listed a stolen database for sale on the PwnForums hacking forum on 12 August, according to BleepingComputer. Access had been obtained by impersonating the credentials of a DGFiP employee and an authorised third party. The same forum post claimed access to the Serveur Professionnel de Données Cadastrales, the platform that fronts France’s central land registry, though the seller said the extraction was never completed.

That sequence has drawn criticism. Filippo Noseda, a partner at Mishcon de Reya who has spent years arguing that government-to-government data transfers erode financial privacy, wrote to the European Commission, the European Council, the European Data Protection Supervisor and the European Data Protection Board. In a letter reported by WealthBriefing and republished on his LinkedIn page, he said the ministry “only came clean after reports in the press”. He asked the EU for a temporary halt and a security audit of all EU and member state systems holding personal and financial data collected in bulk, and wrote separately to the OECD’s Centre for Tax Policy and Administration.

The second register hit this month

This is the second attack in three weeks on a state-held database that matters to wealthy families. Liechtenstein disclosed on 3 August that its Register of Beneficial Owners had been breached, with data on around 31,000 legal entities taken. We covered that incident here.

Neither event on its own changes how families structure their affairs. Together they sharpen a question that advisers have been raising since the Common Reporting Standard came into force: bulk collection creates concentrated stores of sensitive information, and those stores are being targeted. Comparitech recorded 187 ransomware attacks on government agencies worldwide in the first half of 2026, up 13 per cent on the second half of 2025, according to figures cited by WealthBriefing.

What families with French exposure should do

Anyone holding French property or operating a French company may be within the affected set. The DGFiP said it would contact affected individuals and businesses by email or letter with details of what was accessed. Families should treat that correspondence as the trigger for a review rather than the end of the matter, since the taxable income and property data involved is well suited to targeted fraud and social engineering.

Advisers will also want to watch how CNIL handles the notification timeline. Investigations are continuing, and the DGFiP has said the precise volume of extracted data is not yet settled.