Loading story…
Attackers targeted at least 73 French companies with a business email compromise scheme that impersonated the French tax authority and used a spoofed PDF letter to demand sensitive business records. The messages cited supposed SEPA compliance checks and threatened tax penalties to pressure recipients into handing over customer, employee, accounting, and contract information, giving the campaign the appearance of an urgent regulatory request.
The scam relied on the deceptive domain dgfip-finances-gouv[.]cloud, crafted to resemble the legitimate French tax service domain dgfip.finances.gouv.fr, and the attached PDF reportedly reused content from a genuine government document. Metadata in the file even referenced a real government employee, adding credibility to the lure. Researchers said the stolen information was likely intended to help the attackers identify finance personnel and launch follow-on BEC fraud against the victim organizations.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro reported a business email compromise and data-harvesting campaign that impersonated the French tax authority with a spoofed PDF letter requesting sensitive business, customer, employee, accounting, and contract information. Its review found at least 73 different French companies had been targeted in similar emails.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
France’s Ministry of the Economy and Finance confirmed a cyber intrusion into the **Direction générale des Finances publiques (DGFiP)** that exposed data linked to roughly **680,000** individuals and businesses after unauthorized access in late June 2026. Reporting indicates the compromise involved impersonation or misuse of identity and access privileges, with at least **678,437** affected records later advertised for sale on the dark web by an actor calling itself **ZeroBytes**. The exposed population reportedly included both private taxpayers and professionals, and the intrusion was detected during a routine check before access restrictions were tightened. Separate dark-web reporting tied to the same actor alleges a broader compromise of DGFiP-linked cadastral systems affecting **2,041,778** property holders, including land-registry data associating named individuals with fixed addresses and ownership information. Those claims say the attackers used valid credentials and an alleged multi-factor authentication bypass, and that they offered both the stolen data and continued access for sale, although that second breach had not been publicly verified or acknowledged by DGFiP at the time of reporting. The incident raises immediate risk of **phishing**, business email fraud, and other social-engineering attacks using tax, cadastral, and civil-status data.
Aug 20, 2026
Business email compromise (BEC) operators continued to defraud organizations through social engineering-heavy email campaigns that often avoided malware and attachments, instead impersonating executives, employees, and trusted business contacts to request wire transfers, gift cards, contract payments, and invoice changes. Researchers reported that attackers abused a wide range of email infrastructure, including free and local email services, encrypted providers, self-registered look-alike domains, and compromised accounts containing stolen email threads, while also hiding malicious routing through deceptive `Reply-To` addresses and spoofed display names. The activity showed increasing sophistication across industries and regions, with some campaigns using acquisition-related pretexts, telecom-themed domains, multilingual lures, and COVID-19 or tax-related narratives to pressure victims into urgent financial action. Security firms said BEC remained one of the most financially damaging cybercrime threats, particularly in the Americas and Europe, and urged organizations to combine stronger email protections with employee awareness, careful review of sender details, and out-of-band verification for payment or account-change requests.
Aug 15, 2026
A cyberattack on France’s tax authority, the **Direction générale des Finances publiques (DGFiP)**, led to the theft of taxpayer data and prompted Prime Minister **Sébastien Lecornu** to order the creation of a new ANSSI-backed cyber intervention team. Lecornu said too few ministries meet required cybersecurity standards and called on SGDSN secretary general **Nicolas Roche** to rapidly define the unit’s organization, rules of engagement, resources, and leadership so it can intervene before, during, and after serious incidents affecting state information systems. He described the threat environment as massive, organized, and hybrid, involving rival states, criminal networks, and isolated hackers that may act in coordination. The breach has also intensified political opposition to France’s mandatory electronic invoicing rollout, with critics arguing the state has not shown it can adequately protect sensitive data. DGFiP director **Amélie Verdier** said the stolen data is unrelated to the e-invoicing program and defended the reform’s security architecture, while the government kept the implementation timetable unchanged: all businesses must be able to receive electronic invoices from **1 September 2026**, with issuance requirements starting the same day for large companies and mid-sized firms, then extending to SMEs and microbusinesses on **1 September 2027**. A temporary grace period through the end of 2026 will spare good-faith companies from penalties, even as IT teams prepare integrations with one of **138** state-approved private invoicing platforms.
Aug 27, 2026