The French Ministry of Economy and Finance has revealed a massive security failure at the DGFiP, where a hacker known as 'ZeroBytes' stole sensitive tax and property data of nearly 680,000 citizens.

  • 678,000 individuals and professionals had their tax and cadastral data stolen.
  • The breach was exposed by a threat actor named 'ZeroBytes' on the PwnForums hacking forum.
  • Sensitive data leaked includes reference tax income, family quotients, and property sizes.
  • User passwords and IDs remain secure as online accounts were not compromised.

The French Ministry of the Economy and Finance has officially disclosed a significant data breach within the systems of the General Directorate of Public Finances (DGFiP). The incident came to light after a cybercriminal operating under the handle "ZeroBytes" claimed responsibility and attempted to sell the stolen database on the notorious PwnForums hacking community on August 12, 2026.

According to the Ministry, the attacker managed to infiltrate specific access points to extract detailed financial information. For individual taxpayers, the stolen data includes reference tax income, family quotients, and withholding tax rates. For corporate entities, the breach exposed company names and SIREN identification numbers. Furthermore, the attacker gained access to cadastral data, which provides precise details on property addresses and land sizes.

Read Also:Two Young Hackers Sentenced to 5.5 Years for Major TfL Breach

In a bold move, the hacker also claimed to have breached the Serveur Professionnel de Données Cadastrales (SPDC), the central land registry of France. While the portal theoretically provides access to data for 20 million citizens, ZeroBytes admitted that the extraction process was "horrible to scrape" and would have taken months to complete. Consequently, they claim to have stolen approximately 252,149 records covering over 2 million people from this specific source.

Why This Matters

BozokMedia analysis shows that this is not an isolated incident but part of a systemic vulnerability within the French public sector's digital infrastructure. When financial and property data are leaked, it creates a goldmine for targeted phishing and identity theft, as attackers can use exact tax figures to impersonate government officials and defraud citizens.

"The repetition of breaches across multiple French agencies suggests a critical need for a zero-trust architecture rather than relying on perimeter defenses."

The DGFiP has since shut down access to the affected sensitive systems and is working closely with the National Cybersecurity Agency of France (ANSSI) to mitigate the damage. The French Data Protection Authority (CNIL) has also been notified. The government has pledged to notify all affected parties via email or physical mail starting next week.

This breach follows a devastating streak of cyberattacks in France. In January 2026, France Travail was fined €5 million after 43 million people's data was stolen. Shortly after, the FICOBA national bank account registry suffered a breach affecting 1.2 million accounts, and the ANTS agency saw 19 million records put up for sale.

Agency Affected Estimated Records Leaked Data Type
DGFiP (Tax) 678,000 Tax Income & Property
France Travail 43 Million Employment Data
FICOBA 1.2 Million Bank Account Details
ANTS 19 Million Administrative Docs
Did You Know?: The SIREN number mentioned in the breach is a unique 9-digit identification number assigned to French businesses, making it a primary key for corporate identity theft.

Frequently Asked Questions

Q1: Were my passwords stolen in the DGFiP breach?
No, the French Ministry has confirmed that user IDs and passwords were not compromised.

Q2: How will I know if my data was leaked?
The DGFiP will begin contacting affected individuals via email or letter starting next week.