Full Report
Government disputes claims of continued access as investigators measure damage
Analysis Summary
# Incident Report: Compromise of the French General Directorate of Public Finances (DGFiP)
## Executive Summary
In late June 2026, a threat actor successfully breached the French tax authority (DGFiP) using stolen credentials and a multi-factor authentication (MFA) bypass. The incident resulted in the extraction of a database containing information on approximately 2 million taxpayers, which was subsequently offered for sale on a cybercrime forum. While the government confirms the breach occurred, it disputes the attacker's claims of continued persistent access to the network.
## Incident Details
- **Discovery Date:** August 12, 2026 (via public forum posting)
- **Incident Date:** Late June 2026
- **Affected Organization:** General Directorate of Public Finances (DGFiP)
- **Sector:** Government / Public Sector
- **Geography:** France
## Timeline of Events
### Initial Access
- **Date/Time:** Late June 2026
- **Vector:** Identity theft (Stolen credentials) and MFA bypass.
- **Details:** The attacker, operating under the alias "ZeroBytes," utilized compromised credentials to gain entry to the DGFiP information system.
### Lateral Movement
- **Details:** Specific lateral movement techniques were not disclosed, but the attacker successfully navigated from the point of entry to internal databases containing taxpayer records.
### Data Exfiltration/Impact
- **Details:** The attacker extracted a database purportedly containing records for 2 million individuals and professionals. On August 12, the attacker advertised this data for sale, along with claims of continued system access.
### Detection & Response
- **How it was discovered:** The incident was publicly identified when the attacker posted the stolen data on a cybercrime forum. The DGFiP noted that an audit in late June had previously identified and "severed" unauthorized access, though the full extent of the exfiltration was not realized until the public posting.
- **Response actions taken:** DGFiP implemented new access restrictions, launched an in-depth forensic investigation, and initiated the process to notify the CNIL (French data protection watchdog).
## Attack Methodology
- **Initial Access:** Stolen credentials / Identity theft.
- **Persistence:** Contested; attacker claims persistent access, DGFiP claims access was severed in late June.
- **Privilege Escalation:** Not specified, but sufficient to access taxpayer databases.
- **Defense Evasion:** MFA Bypass technique.
- **Credential Access:** Identity theft (likely via phishing or infostealer malware).
- **Collection:** Consultation and extraction of data concerning individuals and professionals.
- **Exfiltration:** Transfer of approximately 2 million records to an external environment controlled by "ZeroBytes."
- **Impact:** Massive data breach and potential for ongoing identity fraud.
## Impact Assessment
- **Financial:** Undisclosed; however, the data is being monetized on the dark web.
- **Data Breach:** Purported 2 million records belonging to French taxpayers.
- **Operational:** Required immediate implementation of new security restrictions and resource-intensive forensic auditing.
- **Reputational:** High; this is part of a series of successful breaches against French government ministries (Finance, Health, Interior) in 2026.
## Indicators of Compromise
- **Network indicators:** None disclosed in the public report.
- **File indicators:** Database exports containing ~2M taxpayer records.
- **Behavioral indicators:** Unauthorized access originating from stolen administrative or user identities; bypass of MFA protocols.
## Response Actions
- **Containment measures:** Implementation of new restrictions to block unauthorized access points.
- **Eradication steps:** Access credentials revoked; audit conducted in June to "sever" unauthorized connections.
- **Recovery actions:** Ongoing forensic investigation to identify every affected user; legal notification to CNIL and impacted citizens.
## Lessons Learned
- **MFA is not a Silver Bullet:** The use of an MFA bypass technique highlights that traditional 2FA may not be sufficient against sophisticated actors; hardware-based or phish-resistant MFA is required.
- **Detection Gap:** The breach occurred in June, but the full scope (the 2-million-record extraction) was only fully acknowledged by the public sector after the data was advertised for sale in August.
- **Credential Hygiene:** The recurring theme of "identity theft" across multiple French agencies suggests a wider issue with credential management or employee susceptibility to phishing.
## Recommendations
- **Implement Phishing-Resistant MFA:** Move toward FIDO2/WebAuthn standards to prevent the bypass techniques used by "ZeroBytes."
- **Enhanced Monitoring:** Increase logging and alerting for large-scale data queries and exports from sensitive taxpayer databases.
- **Third-Party/Credential Audits:** Regularly audit and rotate administrative credentials and monitor for compromised credentials on the dark web.
- **Zero Trust Architecture:** Implement stricter micro-segmentation to ensure that a single compromised credential cannot access a centralized database of millions of records.