A major DGFiP data breach has hit the French tax administration. The Directorate General of Public Finances has confirmed that an attacker exfiltrated information on 678,437 individuals and businesses. The intrusions took place in June and July 2026, but were only publicly claimed on 12 and 13 August. Since 17 August 2026, the DGFiP has been notifying victims individually. The Paris public prosecutor has opened an investigation, handed to the French anti-cybercrime office (Ofac).
What the tax agency leak actually contains
The theft does not cover full tax returns, but the exposed elements remain highly sensitive. According to published information, the leaked data includes:
- the tax identification number (the 13-digit French identifier);
- surname, first name, date and place of birth;
- postal address, phone number and email address;
- the reference taxable income;
- the family quotient;
- the withholding tax rate.
Of the 678,437 people affected, the announced split is 392,867 individuals and 285,570 professionals. In other words, close to four victims in ten are companies, freelancers or similar entities.
How the attacker got in: two legitimate accounts hijacked
The described method is instructive, because it relies on no spectacular technical feat. The attacker used stolen credentials from two entirely legitimate accounts: one belonging to a DGFiP employee, the other to a third party authorised to access the information system.
This scenario has become the norm in large-scale compromises. Rather than breaking through a firewall, the attacker obtains valid credentials — through phishing, an infostealer installed on a workstation, or a purchase on criminal marketplaces — then logs in like any authorised user. From the outside, the activity looks like normal traffic. That is precisely why an intrusion that began in June was only identified several weeks later.
One term keeps appearing in these analyses: credential stuffing, the automated reuse of credentials stolen elsewhere. It explains why multi-factor authentication, including for internal accounts and contractors, has become a prerequisite rather than an option.
Why this leak is more dangerous than it looks
A password can be changed. A tax number, a date of birth or a reference taxable income cannot. That is the core problem with public-sector data breaches: the exposed identifiers are, for the most part, permanent.
The immediate risk is targeted phishing, also known as spear phishing. A fraudster who knows your name, address, tax number and reference income can write a devastatingly credible message. The classic scenario announces a tax refund and asks for your bank details to process the transfer. With accurate data in the header, the message no longer resembles the crude attempts most people spot instantly.
The second risk is identity theft. Reference taxable income and family quotient are used as supporting documents in many procedures: benefit applications, housing files, account openings. Combined with complete civil status details, they form an exploitable dossier.
For the 285,570 professionals concerned, there is an added risk of payment fraud: an attacker who knows a company’s tax situation has credible material to impersonate the administration or a supplier.
What you should do right now
Here are the reflexes to adopt, whether or not you have received a notification.
- Never click a link received by email or SMS about taxes. Type
impots.gouv.frinto your browser yourself, or use the official app. - Remember that the DGFiP never asks for your bank details by message to issue a refund. Refunds go to the account already registered in your personal space.
- Enable two-factor authentication wherever possible, starting with your main mailbox, which is used to reset every other account.
- Change your tax portal password and check that it is not reused on any other service.
- Monitor your bank statements for several months. Stolen data often circulates long after the incident.
- Report any attempt through Phishing Initiative, or via 33 700 for fraudulent SMS in France.
If you receive the official DGFiP notification, do not treat it as routine administrative paperwork: it means your data is confirmed to be in the exposed set, and that you are a priority target for the months ahead.
A wider trend that goes beyond the DGFiP
This DGFiP data breach is part of a series of attacks targeting public administrations and large companies. The logic is simple: centralising services online improves convenience and efficiency, but it concentrates risk. Compromising a single platform is now enough to expose hundreds of thousands of people at once.
European administrations are increasing cybersecurity budgets, but a clear gap remains between the pace of digitisation and the maturity of detection systems. As long as internal access and contractor accounts are not systematically protected by strong authentication, incidents of this kind will keep happening.
Key takeaway
The DGFiP data breach does not empty any bank account by itself. What it does provide fraudsters with is high-quality raw material for tailor-made phishing campaigns. The best protection comes down to one rule: never act from a link you received, always go back to the official site you type yourself.
Have you received the DGFiP notification? Share your experience in the comments to help other readers spot the scam attempts currently circulating.
also:
Share this content: