France Confirms DGFiP Data Breach Affecting 678,000 Individuals and Businesses

• France’s Ministry of Economy and Finance confirmed that illegitimate access to certain DGFiP information systems occurred during June and July 2026 through compromised credentials belonging to a DGFiP employee and an authorised third party. [economie.gouv.fr], [presse.eco…ie.gouv.fr]
• Investigations established that data relating to 678,000 individuals and professionals were consulted and extracted. The affected information included reference taxable income, family quotient and withholding-tax rates for individuals, and company names and SIREN numbers for businesses. Cadastral information was also accessed. [bleepingcomputer.com], [breachhistory.com], [presse.eco…ie.gouv.fr]
• The tax authority stated that individual and professional accounts on the public tax portal were not compromised and that taxpayer usernames and passwords were not taken. DGFiP notified CNIL and implemented additional security measures. [bleepingcomputer.com], [economie.gouv.fr], [presse.eco…ie.gouv.fr]

Extended article

The French Ministry of Economy and Finance has confirmed a significant data breach affecting systems operated by the Directorate General of Public Finances.

A malicious actor publicly claimed illegitimate access on 12 and 13 August 2026. The Ministry confirmed that the underlying access had occurred in June and July 2026 through the impersonated credentials of a DGFiP employee and an authorised third party. [economie.gouv.fr], [presse.eco…ie.gouv.fr]

DGFiP terminated the affected accounts when the intrusions were detected. Initial access checks did not identify that data had already been extracted, which the Ministry attributed to the sophistication of the attack. Subsequent investigations established that information relating to 678,000 individuals and professionals had been viewed and extracted. [bleepingcomputer.com], [presse.eco…ie.gouv.fr]

For individuals, the affected tax data included reference taxable income, family quotient and withholding-tax rates. For businesses, the information included company names and SIREN identifiers. Cadastral data relating to addresses and property surface areas were also consulted. [bleepingcomputer.com], [breachhistory.com], [presse.eco…ie.gouv.fr]

The Ministry stated that taxpayers’ personal and professional online tax accounts were not compromised. Usernames and passwords belonging to taxpayers and businesses were likewise not compromised. [economie.gouv.fr], [presse.eco…ie.gouv.fr]

DGFiP notified the French data-protection authority, CNIL, restricted access to sensitive systems and continued its investigation with the relevant cybersecurity authorities. Affected users are being contacted individually.

The official statements do not identify the French electronic-invoicing platform or approved-platform network as the source of the incident. The breach should therefore not be described as an e-invoicing system breach. It nevertheless reinforces the importance of credential security, access monitoring and third-party controls across digital tax environments. [Lessons fr…FiP breach | Outlook], [economie.gouv.fr], [presse.eco…ie.gouv.fr]

Official external sources: French Finance Ministry press release on the DGFiP breach and official DGFiP information and FAQ. [presse.eco…ie.gouv.fr], [economie.gouv.fr]