France investigates tax authority breach after hacker claims 600,000 victims

France’s tax authority has confirmed that hackers breached its information systems and extracted data on individuals and businesses.

France’s Economy Ministry said late Thursday that an attacker gained unauthorized access to systems at the Directorate General of Public Finances, or DGFiP, in late June after stealing or misusing someone’s identity.

The intrusion allowed the attacker “to view and extract data belonging to individuals and businesses,” according to the ministry.

Officials said the unauthorized access was detected and cut off in late June. The incident became public after a hacker claimed responsibility earlier this week, prompting the tax authority to impose additional restrictions to prevent further unauthorized access.

Authorities are now working to determine precisely what information was accessed or stolen and how many individuals and businesses were affected. The DGFiP said people whose data was compromised will be contacted individually and told what information may have been exposed and what precautions they should take.

The agency said it would also notify France’s data protection authority, file a criminal complaint and provide further information as the investigation progresses.

FrenchBreaches, a website that tracks data leaks in France, reported that the attack was claimed by a hacker using the alias ZeroBytes.

The hacker claimed to have obtained data on more than 600,000 people, including names and other personal information, tax identification numbers, email addresses, family circumstances and details about their tax status. The claim and the authenticity of the purportedly stolen data have not been independently verified.

According to FrenchBreaches, the hacker claimed they gained access to internal servers, which allowed them to connect to the agency’s VPN and use an internal tool to search for information on individuals and businesses. The attacker said they began stealing data before their access was cut off.

The DGFiP has not publicly attributed the breach to a specific threat actor or confirmed the hacker’s claims.

The incident is the latest breach to affect a French government agency this year.

In April, hackers targeted the website of France’s National Agency for Secure Documents, or ANTS, which handles applications for passports, national identity cards, residence permits and driver’s licenses.

That same month, the Education Ministry disclosed that an attack on a system used to manage student accounts had exposed students’ personal information.

In February, hackers also breached part of thr National Bank Accounts File, a database containing records of bank accounts held in France. The incident exposed information linked to roughly 1.2 million accounts out of more than 300 million entries in the database.

French authorities have also been pursuing hackers suspected of targeting public institutions and other organizations. Earlier this year, police arrested a 20-year-old man suspected of carrying out dozens of data breaches involving government bodies, sports federations and private companies.