DGFiP data breach 2026: am I affected by the French tax leak?

The DGFiP data breach: what happened

In mid-August 2026, France's tax authority (Direction générale des Finances publiques, or DGFiP) confirmed the theft of data belonging to 678,000 individuals and businesses. In the days that followed it acknowledged a second intrusion, on the cadastral data server. On 18 August, at a press conference, it announced a third one, on a public portal that nobody saw coming, and the next day the minister laid out a response plan that goes as far as opening a bug bounty programme. No login credentials leaked, and no passwords. What leaked is harder to change: your tax income, your address, the size of your properties, your company registration number, and in some cases the content of your correspondence with the tax office.

You cannot reset a reference tax income the way you reset a password. That is what makes this breach dangerous for the long run, and why it deserves more than a vigilance email skimmed on a Monday morning.

The three intrusions, one vector at a time

This is the part press coverage blurred the most, and it is the heart of the matter: the three accesses have nothing technically in common. Talking about "the cyberattack on the French tax office" in the singular loses the essential point, which is that three different defenses failed.

Intrusion 1: a staff account, then the VPN

The attacker obtained the credentials of a legitimate DGFiP staff account. With them, they logged into the remote-access VPN that staff use to reach their internal tools from outside. From there they got to an internal search tool covering individuals and businesses, and launched an automated extraction.

The ministry describes a "combination of account compromises", one internal staff account and one contractor account. The official statement says "a staff member and an authorized third party". Both wordings circulate, and nobody has clarified which of the two doors served which of the two intrusions.

One important point, rarely stated: how those credentials were obtained is established by nobody. No confirmed phishing, no infostealer identified on a staff machine. Asked about their methods, the attacker answers "a bit of everything, human error, flaws, stupidity, sloppiness", which is not a technical answer. Until the audit settles it, that link in the chain remains a hole.

The account was spotted in late June and cut within twenty-four hours. What went unseen is that the attacker came back in July with a second compromised DGFiP account and the same playbook. Amélie Verdier, the head of the DGFiP, described it at the press briefing: manual tests first, then an automation calibrated to stay below the in-house detection thresholds, what she calls the "mass thresholds". There was never any bulk querying, and that is precisely why there was never any alert.

Detecting an abnormal login and proving a database was siphoned off are therefore two distinct problems, and the second one is far slower. The June and July investigations each treated their incident as an ordinary compromise, without connecting the two. It took until 12 August, and an ANSSI alert that landed at the same time as the public claim, for the administration to understand that data had left.

Intrusion 2: the cadastre, and a bypassed MFA

On 29 July, a month later, the target was the SPDC, the professional cadastral data server. This is not a consumer service: it opens up national cadastral information and is used by authorized staff, but also by outside professionals, notaries and land surveyors first among them. The attacker says they targeted the apexappliext.dgfip.finances.gouv.fr domain.

And here sits the most awkward detail in the whole file: that account was protected by multi-factor authentication, and it was bypassed. The technique has been documented neither by the administration nor by the attacker. So we do not know whether the second factor was intercepted, replayed, or simply badly implemented on that application.

The attacker claims to have stopped the extraction themselves, finding it too slow: pulling everything would have taken "several months". They claim 252,149 rows retrieved.

Intrusion 3: an open portal, not even a password

This one was not claimed, it was found by looking. During the investigation triggered by the first two, the DGFiP discovered illegitimate access to the vacant estates portal, the service that lets anyone holding a claim against a deceased person find out whether there is an heir to present it to.

The problem was not a stolen credential: a vulnerability allowed access to certain information with no prior authentication. It was reported by the security collective LunarisSec, then fixed, and access was cut. The attacker had access to "a log of requests".

Amélie Verdier, head of the DGFiP, places this leak as "really not at all on the same scale" as the previous ones, the exposed information resembling already public "legal notices". The volume has not been disclosed. That nuance is worth holding onto: data being reachable is not data being exfiltrated, and at this stage no mass extraction from that portal has been established.

Technical classification of the three flaws

Official statements talk about "illegitimate accesses", which says nothing about the nature of the defects. Here is the same thing in technical nomenclature. This mapping is our reading of the published facts, it was not established by the DGFiP.

The detail that matters for your own posture: intrusions 1 and 2 are identity problems, intrusion 3 is a code problem. Different teams fix them, and different tools detect them. An access review would have seen nothing of the open portal, and an application scan would have seen nothing of the stolen staff account.

A useful clarification, because the question comes up a lot: no CVE has been published for these three incidents. This is not the exploitation of a known vulnerability in off-the-shelf software, but three defects specific to the DGFiP's information system. Nobody had a patch to apply, and that is precisely what makes this kind of breach invisible to conventional vulnerability inventories.

On the exfiltration itself there is nothing exotic to report, and that is precisely the problem: the attacker set up no clandestine tunnel, they read business screens and automated the pagination. The data left through the normal application channel, the very one staff use all day. Which is why an extraction of 678,438 rows could look, in the logs, like a very diligent civil servant.

Kill chain

The technical sequence of the three intrusions

Phase 1Intrusion 1: 26 June then July 2026

1. 1
   Stolen staff credentials

   origin never established, no confirmed phishing and no infostealer identified.

2. 2
   Access to the internal VPN

   the staff remote-access tunnel becomes the entry point.

3. 3
   Extraction below the thresholds

   manual tests, then an automation paced so it never trips a volume alert.

4. 4
   Account cut in 24h, back in July

   same playbook, second compromised DGFiP account, 678,438 rows in total.

Phase 2Intrusion 2: 29 July 2026

1. 5
   Authorized partner account

   the SPDC cadastral server is open to notaries and surveyors.

2. 6
   MFA bypassed

   the second factor did not hold, the technique remains unknown.

3. 7
   Extraction interrupted

   252,149 rows, stopped by the attacker for being too slow.

Phase 3Intrusion 3: detected 17 August 2026

1. 8
   Portal with no authentication

   vacant estates exposed by broken access control.

2. 9
   Request log accessed

   flaw reported by LunarisSec, fixed, access cut.

Phase 4What comes out of it

1. Tax database put up for sale

   claimed on 12 August, sold to several buyers, still available for resale.

Timeline of the DGFiP data breach

Put the facts back in order and they already tell you where the risk sits.

• June 2026: the Solidaires Finances Publiques union warns the DGFiP leadership about identity theft and targeted phishing risks. No sufficient preventive measure follows before the incident.
• 26 June 2026: first intrusion. The account is cut within twenty-four hours, but the exfiltration is not identified.
• July 2026: the attacker replays the same playbook with a second compromised DGFiP account. Here too, the incident is handled in isolation.
• Mid and late July 2026: the same actor claims an intrusion at the Ministry of Education. They date it 15 July; the ministry places the confirmed access on 25 and 26 July.
• 29 July 2026: second intrusion, on the SPDC cadastral server.
• 10 August 2026: the same actor claims the French Handball Federation, 1,367,197 member records.
• 12 August 2026: an actor going by the handle ZeroBytes claims the theft on a criminal forum and puts the database up for sale. An ANSSI alert reaches the ministry the same day. This is the date the DGFiP holds as the moment it became aware, and it launches its deep investigation straight after.
• 13 August 2026: the ministry confirms the illegitimate accesses. Later that day, the attacker claims the second intrusion, on the cadastre.
• 14 August 2026: detailed official statement. The data protection authority (CNIL) is notified. The ministry's senior defense and security officer and the national cybersecurity agency (ANSSI) are mobilized. A criminal complaint is filed.
• 15 August 2026: the Paris prosecutor opens an investigation, handed to the national anti-cybercrime office (OFAC).
• 16 August 2026: crisis committee at the Prime Minister's office.
• 17 August 2026: ministry press briefing. Individual notifications go out. That is the day the third leak is detected.
• 18 August 2026: press conference. The government apologizes and announces the third leak. The CNIL publishes its position.
• 19 August 2026: the minister details the response plan, which includes opening a bug bounty programme. Calls from worried taxpayers pour into local tax offices.

Forty-eight days separate the first intrusion from the public announcement. On the start of the regulatory clock, though, the DGFiP has now settled the question, and Amélie Verdier's wording leaves no room for doubt: "We learned of the data theft on 12 August, we had no knowledge of it before." The GDPR runs the 72 hours for notifying the supervisory authority from that awareness (Article 33), and requires informing affected people "without undue delay" where the risk is high (Article 34). On that count, 14 August holds.

That position is a comfortable one, though, and it deserves a straight look. One compromised staff account had been cut in late June, a second in July, and nobody connected the two or looked for what had left. "Having no knowledge" of a breach when you have blocked two accounts for the same reason in five weeks is less an absence of information than a failure to use it. That is also what the September audit will have to characterise. In practice, French law excludes the State from administrative fines anyway.

Exactly what data leaked

This is the question that decides everything else, because the risk depends on the nature of the data, not its volume.

On the tax side, the dataset includes the tax identifier (the SPI number), full civil status with dates and places of birth, both the assessment address and the mailing address, the reference tax income, the withholding tax rate, the number of tax shares and dependents, phone numbers and email addresses, plus the history of administrative requests. For businesses, the company name and registration number (SIREN) sit on top of the same categories.

Two items deserve to be pulled out of that list, because they change the caliber of the risk.

First: the notification email sent on 17 August mentions, for individuals, the list of messages exchanged through impots.gouv.fr, content included in some cases. Those are no longer reference figures, they are letters. A dispute, a request for a payment plan, an explanation of a family situation. Far more intimate than a tax income, and far more useful to someone impersonating your contact at the local tax office.

Second: the file is segmented by income level. It contains 26,805 people declaring more than 100,000 euros, 386 above one million, and 8 above ten million. Cross-referenced with the cadastre, that gives you, for one and the same person, how much they earn, what they own and where they live. That is exactly the shopping list of a fraudster sorting targets, and the risk does not stop at payment fraud.

On the cadastral side, the leak describes real estate holdings: names, sex, dates and places of birth, addresses, MAJIC land identifier, department and municipality, parcel section and number, property rights, and even the identity of co-owners.

On the vacant estates side, the exposed information covered identities, postal and email addresses, dates and places of death, marital situations and estate-related assets. That is the perimeter the DGFiP compares to public legal notices.

Official count versus attacker claim: why the gap is huge

This needs to be stated plainly, because the first wave of articles repeated the attacker's claim as fact, and the official assessment then contradicted it.

On the tax side the two counts converge, which is rather reassuring about the honesty of the official assessment. One reservation though: at the 17 August briefing, the ministry announced "350,000 individuals and 250,000 businesses", which does not add up to 678,000. Both series circulate, and the administration still presents its figures as liable to change.

On the cadastre, by contrast, the gap is a factor of five, and it can be explained. The attacker counted rights holders per parcel row. But a single owner appears on as many rows as they own parcels, and jointly held property multiplies the holders. Deduplicating 2,041,778 rights holders brings you back to at most 433,485 individuals and 1,082 businesses, figures the DGFiP presents as a ceiling rather than a settled count. As for the "20 million queryable people", that is not an extraction, it is the attacker's estimate of what they think they could have reached had they stayed. That figure has never been confirmed and should not be quoted as a leak volume.

Worth noting too: a count of 1.8 million cadastral accounts circulated on a few sites. It is incompatible with the 433,485 announced by the ministry and relayed by the AFP news agency, and we do not retain it.

One last figure calls for the same caution: the "3 million people" aggregate across the three leaks, which appeared in several headlines from 18 August onwards. It adds up overlapping scopes (a taxpayer who owns property appears in both the tax leak and the cadastral one) and throws in an estimate for a portal whose volume has not been disclosed. A sum with an unknown term is not a total.

What it would have taken to detect the exfiltration

A practitioner's question, and the one that concerns you most directly: which controls would have stopped this earlier? The three defects call for three different answers, and the cost order is not the one you would expect.

The 18 August briefing gave the single most instructive answer in this whole case, almost in passing. The DGFiP did have volume alert thresholds on queries, its "mass thresholds", and the attacker stayed underneath them. They started with manual tests, then automated at a pace chosen to trip nothing. In other words the control existed and it behaved exactly as it was configured. That is the least comfortable lesson and the most transferable one: a fixed threshold always gets found in the end, and once found it becomes a safety ceiling for the attacker, not for you.

• Per-account query quotas. This is the measure the ministry is announcing, and it is the most effective of the three for a trivial budget. A civil servant consulting 400 files a day is doing their job, an account consulting 40,000 is doing nothing a human does. A cap does not prevent the intrusion, it bounds the theft. It just has to apply to a long-running total, a week or a month: a daily cap is defeated by spreading the load, which is exactly what happened here.
• Behavioral detection on privileged accounts. Unusual hours, abnormal volume, a page sequence that is too regular: these are the signals a UEBA engine surfaces and that conventional event correlation misses, because request by request everything is authorized. Its real value here would have been comparing an account against itself rather than against a global threshold: the regularity of a script shows even at a low rate.
• Connecting incidents to each other. Two staff accounts cut for compromise in five weeks is a pattern, not two unrelated events. Each was handled in isolation and closed. Plenty of organizations do the same, because ticket closure is a tracked metric and looking for recurrence is not.
• Logging you can actually analyze afterwards. The dark spot in this case is not access detection, which worked in late June, it is the inability to establish for six weeks whether data had left. Logging accesses without logging volumes makes impact analysis impossible.
• An up-to-date inventory of exposed entry points. The vacant estates portal flaw was a critical function with no authentication on a public application. Unlike the other two, that defect is visible from the outside, with no privileged access whatsoever. That is the whole point of an external attack surface inventory, and it is also what a well-chosen vulnerability scan picks up, provided the scanned perimeter actually contains that portal.

Note the asymmetry: two of the three flaws were only visible from the inside, the third was visible from anywhere. In most organizations it is the third category that lingers longest, because nobody knows it exists. A current inventory of your information system is the prerequisite, not a compliance deliverable.

Why a tax record is worth more than a stolen password

You change a password. You do not reset an address, an income figure, the size of a property, a co-ownership link. That information stays accurate for years, and that is exactly what makes it valuable to a scammer.

Tax data is the fuel for convincing phishing. A fake message that reminds you of your exact reference tax income, your address and your town no longer looks like clumsy spam. It looks like a letter from the tax office. Add the subject line of a message you genuinely sent the tax office back in March, and the mental check an attentive recipient performs is worth nothing anymore. The taxpayer who is precisely waiting for the email the DGFiP announced is, that week, the easiest target there is: the real message and the scam land in the same inbox, the same week, and the fraudsters know it.

For a company, the risk climbs a notch. Cross-reference a registration number, a company name, an address and a financial detail, and you get the perfect setup for CEO fraud or a fake supplier scam. The attacker no longer has to guess: they cite verifiable facts, and it is that accuracy that disarms your finance team's caution.

Kill chain

From stolen data to fraud

1. 1
   Exposed tax data

   income, address, company number, real estate, a base of truth that is hard to change.

2. 2
   Credible message

   the attacker cites accurate facts, so the email no longer reads as spam.

3. 3
   Trust earned

   they pose as the tax office, a notary, a bank, or a known supplier.

4. 4
   Action triggered

   a payment gets rerouted, a document is sent, a credential is typed on a fake page.

5. Loss realized

   funds diverted or identity stolen, hard to undo once it has happened.

The tax office calls the risk "low" for businesses. That is not how we read it

This is the line in the case we want to argue with, because it is going to be quoted everywhere and it is reassuring the wrong people.

Defending its assessment on the business side, the DGFiP explains that for "the overwhelming majority" of them, the information involved is public or near-public: the company registration number, the address, the identity of the legal representative. Strictly as a legal matter, that is correct. Those items are already in the companies register, and anyone can pull them in thirty seconds.

Except the reasoning treats each field separately, while fraud is built out of the whole set. What has value to a fraudster is not the registration number, which they could already read elsewhere. It is finding it already matched to a tax address, a named director, a history of filings and sometimes a thread of messages exchanged with the local tax office. The aggregation work, the part that costs time and exposes an attacker when they do it themselves, was done by the administration and then handed over ready-made. A public data point and a public data point correlated with five others do not carry the same risk, and that holds for every breach, not just this one.

Two caveats sit on top, and they are in the statement itself. "The overwhelming majority" is not all of them: the DGFiP said it was still checking the content of certain tax messages, which are nothing like public. And the cadastral leak covers named property holdings, with joint owners, which bears directly on directors whose company is their main asset.

The backdrop is all the more favourable given that fraud against businesses is already running high, quite apart from this affair. The Allianz Trade and Odoxa barometer published in June 2026 (315 executives and CFOs surveyed) puts 60% of small and mid-sized firms and 85% of larger companies as having faced at least one fraud attempt over the year. Among the companies hit, external fraud accounts for 88%, with supplier impersonation at 42% and customer impersonation at 41%. Four attempts out of ten succeed. What the breach changes is not how often attempts come, it is how often they work: the main filter an accounts team applies is the implausibility of the message, and that is exactly what the stolen data removes.

Our reading, in one sentence: the risk is not low, it is deferred and indirect. It will not show up as an intrusion into a business impots.gouv.fr account, but as a payment sent to the wrong recipient, in six weeks or in six months, on the strength of a message too well informed to raise a doubt.

Am I affected by the DGFiP breach? How to check without getting caught

The official rule is simple, and it protects first against the scam riding on the breach.

The DGFiP contacts each affected person directly, by email or mail, since Monday 17 August 2026. The message carries a subject line along the lines of "illegitimate consultation of your tax information", opens with "you are affected by this malicious act", details the data that may have been viewed or extracted, and contains no link at all. Hold on to that last point, it is the only useful test: the genuine message has nothing to click, so any message that does is suspect by construction.

Still, an email claiming to come from the DGFiP is not proof, it is in fact the most likely attack scenario right now. The right reflex fits in one sentence: don't click any link you receive, and verify the information by typing impots.gouv.fr into your browser yourself to log in to your secure account.

For an organization, individual notification is not enough to measure real exposure. A director, a CFO, an accountant can appear in the leak in a personal capacity while also being a way into the company. And a director's cadastral data is usable against their business. Knowing precisely who, inside your perimeter, is likely to appear in the circulating datasets changes how you prepare your teams.

That is exactly what we do at Flawfence. We can tell you whether your organization appears in the data leaks in circulation, DGFiP included, and above all measure what that exposure actually opens up in terms of fraud scenarios against you. We never work from the stolen data itself: we cross-reference public compromise signals with your perimeter, with your consent and at your request, to produce a usable exposure assessment, not a list of names bought on a forum. The distinction is not cosmetic, it is what separates a security service from handling stolen goods.

DGFiP breach: what to do now, the checklist

The urgent task is not to change passwords that did not leak. It is to make useless the scams that will lean on this data for months.

• Brief your finance and leadership teams, by name. The message to land: an urgent payment request, even one accurate in its details, is always verified through a known, separate channel. That is the only defense against CEO fraud.
• Harden authentication everywhere you can, even though passwords did not leak. Stolen data also helps answer security questions and lend credibility to a fraudulent reset. And remember that on the cadastral server a second factor did exist and was bypassed: MFA only protects you if its implementation holds.
• Check your email posture: correctly configured SPF, DKIM and DMARC records make it harder for fraudsters to spoof your own domain. It is concrete, measurable work, and often neglected.
• Review your partner and contractor access. Two of the three doors in this case were third-party accounts. Who, outside your organization, holds access to your data, at what privilege level, and how long has it gone without review?
• Never react to an unsolicited message asking for a code, a login, bank details or a payment, even if it cites accurate information about you. Accuracy is no longer proof of authenticity.
• Document and report, in the right place. The official channels exist and are barely used: a phishing email is reported at signal-spam.fr, a text message by forwarding it to 33700, fraudulent card use through the Perceval service on service-public.fr, and cybermalveillance.gouv.fr guides victims, individuals and businesses alike. Keep the official notification too if you received one: it is the document that establishes you were in scope.

What the DGFiP is announcing to fix it

On 18 August, David Amiel, the minister for public accounts, issued a public apology: "Yes, we apologize, because what happened is unbearable for the French people." He calls the attack "particularly sophisticated". The plan detailed the following day comes down to seven measures:

• Strong authentication rolled out to every ministry staff member by the end of 2026, a project presented as "already well under way". Staff passwords have also been reset.
• A full audit with support from the ANSSI in September 2026, with conclusions to be sent to the finance committees of both houses of parliament.
• A redesign of the detection systems and data access quotas, so that an extraction spread over time stops looking like ordinary browsing.
• Early-warning sensors deployed across all systems.
• A full review of data access rights, including those of external partners.
• A bug bounty programme, meaning payment for security researchers who report a flaw in the DGFiP's digital services.
• Stronger cyber training, intensified internal phishing simulation campaigns, and use of artificial intelligence to simulate attacks and propose fixes. "It will be used by attackers, it has to be used to defend", as Amélie Verdier puts it.

Two comments, since this is our trade. The bug bounty is the right answer to the third leak and to that one only: a portal reachable without authentication is exactly what an outside researcher finds, and a collective, LunarisSec, is in fact who reported it. It will never see a stolen staff account, though, because there is nothing to find from the outside. Two thirds of this case escape it by construction, and it would be a shame if its visibility pushed the access review into second place.

The second point is the timing. Strong authentication for every staff member by the end of 2026 means it was not in place in June 2026, in an administration that runs the country's tax records. And on the cadastral server a second factor did exist and did not hold, a reminder that the announced measure only protects you if its implementation does.

Socialist senators, for their part, are calling for a parliamentary inquiry commission, pointing to the repetition of security failures at the ministry. On that last point they are not wrong, which is the subject of the next section.

A repeat, not an accident

Here is the fact that, to our eyes, changes how the whole case reads, and that got very little attention.

Six months earlier, between late January and 13 February 2026, an attacker had already browsed FICOBA, the French national bank account register, using the stolen credentials of a civil servant from outside the DGFiP authorized under inter-ministerial information exchange. The toll: roughly 1.2 million people, with bank details, identity, address and in some cases the tax identifier. Same administration, same vector, twice in the same year. After that episode, the Solidaires Finances Publiques union had already asked for a review of IT priorities.

The figures that came out of the press briefing and the unions give the context, and they are stubborn:

• 52.2%: the DGFiP's compliance rate against its own technology target at the end of 2025. The ministry points out it has doubled since 2020, which means it stood at 26% five years ago.
• 100 posts dedicated to cybersecurity for 5,300 IT staff at the ministry, under 2%.
• 6,972 security incidents in 2025, against 2,579 in 2023, including 57 actual compromises.
• 34,000 posts cut at the DGFiP since 2008, more than 28% of headcount, according to the CGT Finances publiques union.

Add the regulatory picture, because it is quite something. The NIS 2 directive, which requires precisely this kind of entity to raise its security bar and report its incidents, is still not transposed into French law. The resilience bill was introduced in October 2024, passed the Senate in March 2025, and its reading in the lower house is pushed to September 2026 at the earliest. The European Commission referred France to the Court of Justice of the European Union on 8 July 2026 over that delay. The administration that just got siphoned three times is also the one whose government has not finished transposing the text that would oblige it to do better.

Who ZeroBytes are

The actor behind the first two intrusions presents as a duo, and owns a strictly financial motivation: "money is the main motivation of any person, along with the desire for power", and "I have no political motivations". Contact over Telegram, resale on a criminal forum. They claim to have already sold part of the tax file to several buyers for "several thousand euros", with the data still available for resale. That is the detail that matters to you: this database is not locked in a vault, it is circulating.

On French security, they do not mince words, saying they want "people to wake up and see how much of a joke France is". They also announce that "the tax office was only the beginning".

Their claimed 2026 record goes well beyond the tax authority: the Ministry of Education (346,178,591 raw rows, roughly 43 gigabytes across 2,500 files, 1,224,291 unique pupils after deduplication, and a 17.8 gigabyte batch pulled from I-Prof containing staff social security numbers going back to 2001), the French Handball Federation (1,367,197 records), Intermarché Drive and France VAE. A telecom operator and a hotel group are also mentioned, unconfirmed.

On the judicial side, the Paris prosecutor's investigation, handled by the OFAC, covers fraudulent extraction of personal data held in a State-operated automated processing system, criminal conspiracy, and fraudulent access to and continued presence in an automated data processing system as an organized gang. Those charges are not decorative: organized gang and criminal conspiracy carry a sentencing range well above simple unauthorized access.

What this breach says about access-based security

There is a deeper lesson, beyond the DGFiP case. None of the three intrusions broke encryption or used an unknown flaw. Two reused legitimate credentials, those of a staff member and an authorized partner, and slipped under the radar because, from the inside, they looked like normal activity. The third did not even need a credential: the access control was missing.

That is the most common shape of large breaches, and the hardest to detect. You don't prevent it with more barriers alone, but by watching what is actually exposed and who can reach it. The bypassed MFA on the cadastral server should serve as a warning to everyone: ticking the "two-factor authentication enabled" box in a compliance sheet says nothing about how solid the implementation is.

The right question after a breach like this is not "were we hacked," but "what would an attacker looking at our surface see today, and what information do they already hold to get through it." That is the angle we defend, and the one behind our external attack surface analysis.

Glossary of terms in this case

The acronyms in this case are opaque to anyone who does not work at the French tax authority, and the press uses them without defining them.

Frequently asked questions

How many people are affected by the DGFiP breach?

Three separate leaks have been confirmed. The tax leak affects 678,000 individuals and businesses. The cadastral leak affects at most 433,485 individuals and 1,082 businesses according to the ministry's 18 August assessment, not the 2 million initially claimed by the attacker, who counted rights holders per parcel without deduplicating. The volume of the third leak, on the vacant estates portal, has not been disclosed. The figure of 20 million "queryable" people is an attacker estimate and has never been confirmed.

How many intrusions were there, and by what means?

Three, with different playbooks. On 26 June 2026, stolen staff credentials gave access to the internal VPN and then to a tax search tool. On 29 July 2026, an authorized partner account allowed entry into the SPDC cadastral server, with the multi-factor authentication bypassed. The third, detected on 17 August 2026, relied on no credential at all: the vacant estates portal let people reach information with no prior authentication.

Did my impots.gouv.fr password leak?

No. According to the official statement, users' credentials and passwords were not compromised, and none of the three intrusions gave access to a tax account or made it possible to recover access codes. You don't need to change your password for this reason, though enabling stronger authentication is still good practice.

Am I affected by the DGFiP breach, and how do I check?

The DGFiP contacts each affected person individually, by email or mail, since Monday 17 August 2026. The genuine email carries a subject line mentioning an illegitimate consultation of your tax information and contains no link. Don't click any link you receive, and verify the information by typing impots.gouv.fr into your browser yourself. For an organization, an exposure assessment identifies the key people likely to appear in the circulating datasets.

Did the content of my correspondence with the tax office leak?

Possibly. The notification email mentions the list of messages exchanged through impots.gouv.fr, and states that in some cases their content is affected. This applies to the first leak, the one hitting the tax message database. It is a point often left unsaid, and it is more sensitive than a reference tax income.

How do I know if my company is affected by the DGFiP breach?

No public list lets you check, and the DGFiP notification goes to individuals, not to companies. Two angles need handling separately. First the entity itself: the tax leak contains company names and registration numbers, so a business can appear in it directly. Then its executives and sensitive roles, in a personal capacity, which is the vector most often used afterwards against the company. An exposure assessment crosses both and says which fraud scenarios that actually opens, without ever handling the stolen data.

What is the main risk after this breach?

Targeted phishing and identity fraud. Tax and cadastral data make fraud attempts very credible: fake messages from the administration, fake notaries, fake bank advisers, or CEO fraud aimed at businesses. Because the file carries a segmentation by income level, with 26,805 people declaring more than 100,000 euros, sorting high-net-worth targets is immediate. The risk of direct account access, on the other hand, is low, since passwords did not leak.

Can a company be targeted even though the leak concerns individuals?

Yes. The leak also affects businesses (company name, SIREN), and a director's or accountant's personal data is used to build attacks against their organization. A fake supplier or CEO fraud relies precisely on that kind of accurate information.

Which CVE was exploited in the DGFiP breach?

None. This is an important and often misunderstood point: the three intrusions do not rest on a published vulnerability in off-the-shelf software. Two exploit stolen legitimate credentials, the third a broken access control specific to a DGFiP application. So there is no CVE identifier and no vendor patch to apply, and no scanner working from a CVE database would have flagged anything.

What is the DGFiP's SPDC?

The SPDC, or professional cadastral data server, is the application that opens up national cadastral information: parcels, associated rights, holders. It is available to authorized staff but also to outside professionals, notaries and land surveyors in particular. It is the target of the second intrusion, on 29 July 2026, through the account of an authorized partner whose multi-factor authentication was bypassed.

How can multi-factor authentication be bypassed?

In the SPDC case, neither the administration nor the attacker documented the method. Generally a second factor falls in one of four ways: interception of the one-time code, theft of a valid session cookie after authentication, wearing the user down with repeated push notifications until they approve, or an implementation that only requires the second factor on certain entry paths. The operational lesson is the same in all four: the presence of MFA in a compliance sheet says nothing about how solid its implementation is.

Which OWASP and CWE categories do these three flaws map to?

The first two fall under A07 (Identification and Authentication Failures) of the OWASP Top 10 2021, with CWE-522 for insufficiently protected credentials and CWE-287 for improper authentication. The third falls under A01 (Broken Access Control) and CWE-306, a critical function reachable without authentication. This mapping is a technical reading of the published facts, it does not come from the DGFiP.

Would a vulnerability scan have detected these flaws?

For the third, yes: a critical function reachable without authentication on a public application is visible from the outside, and that is typically what an external surface scan surfaces. For the first two, no: a legitimate account used by the wrong person produces no vulnerability signature. That is the limit to keep in mind when assessing which vulnerability scan to use, and the reason an access review and an exposure inventory are two separate projects.

Is the risk really "low" for businesses, as the DGFiP says?

The DGFiP states that for "the overwhelming majority" of businesses, the data involved is public or near-public: registration number, address, legal representative. That is legally accurate, but it describes each field in isolation. The risk comes from aggregation: finding those items already matched to a tax address, a filing history and sometimes correspondence with the local tax office spares the fraudster the cross-referencing work, which is the longest and most detectable part. The risk is not nil, it is deferred: it materialises as payment fraud, not as an intrusion into a business account.

Why did the DGFiP take forty-eight days to announce the breach?

Because it says it only learned of it on 12 August. Amélie Verdier, its director general, put it this way: "We learned of the data theft on 12 August, we had no knowledge of it before." Two compromised staff accounts had indeed been spotted and cut, in June then in July, but each incident was handled in isolation and the exfiltration was not established. It was an ANSSI alert, concurrent with the public claim, that triggered the investigation. The 72-hour clock in Article 33 of the GDPR runs from awareness, and the 14 August notification to the CNIL fits inside it.

How did the attacker evade the DGFiP's alerts?

By staying under the thresholds. The DGFiP has "mass thresholds" that raise an alert beyond a certain query volume. The attacker ran manual tests first, then automated the extraction at a pace calibrated never to cross them: there was no bulk querying, so there was no alert. That is the limit of any control tuned to a fixed threshold, and the argument for behavioural detection that compares an account against its own habits rather than against a global value.

How do I report a fraud attempt linked to the DGFiP breach?

A phishing email is reported at signal-spam.fr, a text message by forwarding it to 33700, and fraudulent card use through the Perceval service on service-public.fr. The cybermalveillance.gouv.fr portal guides victims, individuals and businesses alike, and gives access to the 17Cyber desk. Keep the official DGFiP notification if you received one, along with the suspicious messages: those are the useful documents if a loss materialises.

Can I file a complaint or contact the CNIL?

The CNIL has been notified by the DGFiP and is running its checks, in particular on whether the security measures in place match the state of the art. An individual complaint is not necessary unless you hold specific evidence useful to the investigation. You can keep the official notification and document any harm or fraud attempt. Some law firms have also announced class actions, and senators are calling for a parliamentary inquiry commission.

Is this the first leak of its kind at the DGFiP?

No, and that is the most worrying part. From late January to 13 February 2026, an attacker had already browsed the FICOBA national bank account register using the stolen credentials of a civil servant from outside the DGFiP authorized for inter-ministerial exchanges, exposing roughly 1.2 million people along with their bank details. The vector is the same: a legitimate third-party account.

Conclusion

The August 2026 DGFiP breach does not steal passwords, it steals something more stubborn: facts about you and your company that will stay true for a long time. And it is not an isolated accident, but the third access failure at the same administration in eight months, two of them through third-party accounts.

The risk does not close by changing a login. It is managed by making your teams immune to the scams that will lean on this data, by reviewing who reaches what at your organization and at your contractors, and by knowing precisely what, on your side, is exposed.

Have Flawfence assess your exposure: we map your surface, identify your exposed key people, and tell you what to lock down first.

Sources

• Statement from the French Ministry for Public Accounts, 14 August 2026 (in French)
• CNIL, "Hacking of the tax information system: checks under way" (in French)
• Next, "Third leak confirmed at the tax authority, the ministry details its response" (in French)
• AFP, "The government apologizes, a third leak spotted and cut off", 18 August 2026 (in French)
• FrenchBreaches, technical record of the DGFiP leak (in French)
• Solidaires Finances Publiques union, "We warned about the risks back in June" (in French)
• Journal du Net, "The ministry for public accounts apologizes and announces emergency measures", 19 August 2026 (in French)
• Toutsurmesfinances, "How the tax office let the data theft slip through" (in French)
• Allianz Trade and Odoxa, 2026 business fraud barometer (in French)
• Cybermalveillance.gouv.fr, phishing response sheet (in French)

Published on 18 August 2026, updated on 19 August 2026 with the ministry's response plan, the date the DGFiP holds as the moment it became aware, the detail of the detection thresholds that were slipped under, and the deduplicated cadastral count. The figures quoted are those known as of that date. The administration still presents its assessments as provisional, and the ANSSI audit due in September may move them.