Full Report
The French Ministry of the Economy and Finance has disclosed a data breach after an attacker accessed the General Directorate of Public Finances (DGFiP) systems and stole data belonging to 678,000 individuals. [...]
Analysis Summary
# Incident Report: French DGFiP Data Breach (ZeroBytes)
## Executive Summary
The French Ministry of the Economy and Finance suffered a significant data breach targeting the General Directorate of Public Finances (DGFiP). A threat actor, "ZeroBytes," accessed sensitive tax and land registry systems, exfiltrating the personal and financial data of 678,000 individuals and professionals. While user credentials were not compromised, the breach exposed sensitive tax income data and cadastral records, leading to a coordinated response by ANSSI and the CNIL.
## Incident Details
- **Discovery Date:** August 12, 2026
- **Incident Date:** Ongoing prior to August 12, 2026
- **Affected Organization:** General Directorate of Public Finances (DGFiP)
- **Sector:** Government / Finance
- **Geography:** France
## Timeline of Events
### Initial Access
- **Date/Time:** Undisclosed (Prior to August 12)
- **Vector:** Unauthorized access to "access points"/online portals.
- **Details:** The attacker gained access to the *Serveur Professionnel de Données Cadastrales* (SPDC) and other sensitive DGFiP information systems.
### Lateral Movement
- **Details:** The threat actor navigated from initial access points to databases containing tax records (reference income, withholding rates) and business registry data (SIREN numbers).
### Data Exfiltration/Impact
- **Exfiltration:** The attacker claimed to have scraped data on over 2 million people; government investigations confirmed the extraction of data for 678,000 entities.
- **Scope:** Tax data (reference income, family quotient, withholding rates), business names, SIREN numbers, and cadastral data (property size and addresses).
### Detection & Response
- **Detection:** Discovered after the threat actor "ZeroBytes" posted a stolen database for sale on the PwnForums hacking forum on August 12.
- **Response:** The DGFiP shut down access to the compromised systems, launched an investigation with ANSSI, and notified the French Data Protection Authority (CNIL).
## Attack Methodology
- **Initial Access:** Exploitation of legitimate access points or portals (SPDC).
- **Persistence:** Attacker remained logged into the administrative panel during the data sale period.
- **Collection:** Large-scale "scraping" of the online land registry and tax databases.
- **Exfiltration:** Systematic extraction of records over an extended period until interrupted.
- **Impact:** Unauthorized disclosure of sensitive financial and personal identification data.
## Impact Assessment
- **Financial:** Potential for increased tax fraud and identity theft against French citizens.
- **Data Breach:** 678,000 individuals and professionals affected; data includes tax reference income and property details.
- **Operational:** Temporary shutdown of sensitive information systems and land registry portals.
- **Reputational:** High; follows a series of high-profile breaches at other French agencies (France Travail, France Titres).
## Indicators of Compromise
- **Network indicators:** Access from unauthorized IPs associated with the "ZeroBytes" actor (specific IPs not disclosed in the report).
- **Behavioral indicators:** Unusual volumes of database queries/scraping activity on the SPDC portal; prolonged active sessions on administrative panels.
## Response Actions
- **Containment:** Immediately shut down access to the affected sensitive information systems.
- **Eradication:** Terminated active unauthorized sessions and revoked compromised access points.
- **Recovery:** Initiated a forensic investigation with ANSSI; planned mass notification via email and letter to all 678,000 victims starting the week of August 17.
## Lessons Learned
- **Monitoring Gaps:** The breach was discovered via a forum post rather than internal telemetry, indicating a need for better anomalous behavior detection (e.g., detecting large-scale scraping).
- **Public Disclosure:** The attacker highlighted a perceived lack of transparency from the government ("no mention from France"), emphasizing the importance of timely public communication.
- **Third-Party/Portal Risk:** External-facing portals like SPDC provide high-value data and require stricter rate-limiting and session management.
## Recommendations
- **Implement Rate Limiting:** Enforce strict thresholds on data exports and queries to prevent bulk scraping of cadastral and tax records.
- **Enhanced Monitoring:** Deploy User and Entity Behavior Analytics (UEBA) to identify sessions that deviate from standard administrative or professional patterns.
- **Multi-Factor Authentication (MFA):** Ensure all "access points" to sensitive government databases require robust MFA to mitigate the risk of credential theft or session hijacking.
- **Dark Web Monitoring:** Continue proactive monitoring of cybercrime forums to reduce the "dwell time" between exfiltration and discovery.