Loading story…
A cyberattack on France’s tax authority, the Direction générale des Finances publiques (DGFiP), led to the theft of taxpayer data and prompted Prime Minister Sébastien Lecornu to order the creation of a new ANSSI-backed cyber intervention team. Lecornu said too few ministries meet required cybersecurity standards and called on SGDSN secretary general Nicolas Roche to rapidly define the unit’s organization, rules of engagement, resources, and leadership so it can intervene before, during, and after serious incidents affecting state information systems. He described the threat environment as massive, organized, and hybrid, involving rival states, criminal networks, and isolated hackers that may act in coordination.
The breach has also intensified political opposition to France’s mandatory electronic invoicing rollout, with critics arguing the state has not shown it can adequately protect sensitive data. DGFiP director Amélie Verdier said the stolen data is unrelated to the e-invoicing program and defended the reform’s security architecture, while the government kept the implementation timetable unchanged: all businesses must be able to receive electronic invoices from 1 September 2026, with issuance requirements starting the same day for large companies and mid-sized firms, then extending to SMEs and microbusinesses on 1 September 2027. A temporary grace period through the end of 2026 will spare good-faith companies from penalties, even as IT teams prepare integrations with one of 138 state-approved private invoicing platforms.
See the actors and campaigns active against you right now.
8 events from the most recent confirmed update back to the earliest known activity.
Franceinfo reported that the French tax administration, the Direction générale des Finances publiques (DGFiP), had suffered a cyber incident that resulted in data theft affecting taxpayers.
Lawyer Jeremy Roche organized a coordinated individual effort to seek compensation from the French state for people notified of either DGFiP-related data breach. Roche said more than 1,200 people had joined; the initiative may include CNIL and criminal complaints and, where applicable, administrative-court proceedings.
CGT, Solidaires Finances publiques, and Force ouvrière criticized DGFiP for prioritizing productivity, digital expansion, and interconnection over technical-debt remediation, cybersecurity staffing, and system security. DGFiP said it would assess processes for rapid security-patch deployment and establish alerts for unusually large volumes of data consultations.
Following the DGFiP compromise, the tax administration closed access for external partners and announced plans to generalize multi-factor authentication for its agents. The response followed concerns that compromised high-privilege functional accounts could expose large volumes of taxpayer data.
DGFiP director Amélie Verdier said the stolen DGFiP data had no connection to the electronic invoicing reform and defended the security of the reform's architecture.
Following the DGFiP data breach, critics including David Lisnard and Sarah Knafo called for immediate suspension of France's mandatory electronic invoicing rollout, while Jean-Luc Mélenchon criticized the privatized dematerialization model.
On X, Sébastien Lecornu said the cyber threat facing the French state was massive, organized, and hybrid, involving competitor states, criminal networks, and isolated hackers that may act in coordination.
In response to the DGFiP hack, Prime Minister Sébastien Lecornu sent a letter to SGDSN secretary general Nicolas Roche calling the ministries' cybersecurity posture unacceptable and requesting creation of a new ANSSI-backed "contact team" for serious state cyber incidents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourcezdnet.fr
Open sourcezdnet.fr
Open sourcezdnet.fr
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
France has established **REACTIV**, an interministerial cyber incident-response mechanism that authorizes the National Agency for the Security of Information Systems (ANSSI) to require ministries to implement urgent technical safeguards within set deadlines and to centrally manage technical crisis communications. The measure is intended to protect government services and citizens’ data during major intrusions and breaches. The initiative follows compromises at the Directorate-General for Public Finance (DGFiP) that reportedly exposed data on between 350,000 and 678,000 taxpayers, as well as an intrusion at the National Agency for Secure Documents (ANTS). Two alleged ZeroBytes members, aged 16 and 18, were arrested in late August in connection with the DGFiP attack. France also plans mandatory multifactor authentication for government administrators, broader deployment of hardware security keys, and a €200 million government IT-security architecture overhaul; REACTIV’s own staffing and funding remain undisclosed.
Sep 10, 2026
France’s Ministry of the Economy and Finance confirmed a cyber intrusion into the **Direction générale des Finances publiques (DGFiP)** that exposed data linked to roughly **680,000** individuals and businesses after unauthorized access in late June 2026. Reporting indicates the compromise involved impersonation or misuse of identity and access privileges, with at least **678,437** affected records later advertised for sale on the dark web by an actor calling itself **ZeroBytes**. The exposed population reportedly included both private taxpayers and professionals, and the intrusion was detected during a routine check before access restrictions were tightened. Separate dark-web reporting tied to the same actor alleges a broader compromise of DGFiP-linked cadastral systems affecting **2,041,778** property holders, including land-registry data associating named individuals with fixed addresses and ownership information. Those claims say the attackers used valid credentials and an alleged multi-factor authentication bypass, and that they offered both the stolen data and continued access for sale, although that second breach had not been publicly verified or acknowledged by DGFiP at the time of reporting. The incident raises immediate risk of **phishing**, business email fraud, and other social-engineering attacks using tax, cadastral, and civil-status data.
Aug 20, 2026
Attackers targeted at least 73 French companies with a business email compromise scheme that impersonated the French tax authority and used a spoofed PDF letter to demand sensitive business records. The messages cited supposed **SEPA compliance checks** and threatened tax penalties to pressure recipients into handing over customer, employee, accounting, and contract information, giving the campaign the appearance of an urgent regulatory request. The scam relied on the deceptive domain `dgfip-finances-gouv[.]cloud`, crafted to resemble the legitimate French tax service domain `dgfip.finances.gouv.fr`, and the attached PDF reportedly reused content from a genuine government document. Metadata in the file even referenced a real government employee, adding credibility to the lure. Researchers said the stolen information was likely intended to help the attackers identify finance personnel and launch follow-on **BEC fraud** against the victim organizations.
Aug 14, 2026