> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # French tax authority admits data heist after crook touts 2M records - URL: https://f4n6.co.uk/security-feed/french-tax-authority-admits-data-heist-after-crook-touts-2m-records/ - Published: 2026-08-14T15:44:00.000Z - Updated: 2026-08-14T15:44:00.000Z - Author: Jeff Davies - Tags: #security-feed, ZeroBytes ## 1\. Executive summary On 2026-08-12, a cybercriminal using the alias "ZeroBytes" advertised a database claiming to contain records of more than 2 million French taxpayers on a cybercrime forum, allegedly exfiltrated from the General Directorate of Public Finances (DGFiP). DGFiP confirmed that an intruder gained access at the end of June 2026 via identity theft (stolen credentials) and an MFA bypass technique, consulted and extracted data concerning individuals and professionals, and had their access severed during an audit before the forum advertisement surfaced. ZeroBytes also claimed to retain ongoing access to DGFiP systems and offered to sell it alongside the database — a claim DGFiP disputes. Attribution to "ZeroBytes" is unconfirmed: the actor has no MITRE ATT&CK profile in verified reference data, and the claim rests on a single source. No CVE, CVSS, or CISA-KEV data applies to this incident. For EMEA financial services, the primary risk is indirect: stolen taxpayer data (names, fiscal identifiers, potentially bank details) can fuel socially engineered fraud, account-takeover, and impersonation attacks targeting retail and corporate banking customers. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | DGFiP stated it would report the breach to CNIL — a competent authority — and notify affected users. This is a public-sector incident, not a financial-entity incident, but EMEA financial firms receiving downstream fraud attributable to this data should assess whether their own ICT-related incident classification thresholds under Art. 18 are met. | If a client institution detects a spike in account-takeover or fraud attributable to DGFiP-exfiltrated data, that downstream incident may trigger the client's own Art. 19 reporting obligation. | | NIS2 Art. 23: incident reporting obligations | DGFiP is a public-sector body; this incident does not directly engage NIS2 for financial firms. However, if a NIS2-in-scope organisation experiences a related incident (e.g., credential reuse leading to compromise) traceable to this data, Art. 23 reporting may be engaged. | Clients should correlate any anomalous authentication events against this timeline and assess notification triggers. | No specific DORA article on third-party risk (Art. 28–30) is directly engaged: DGFiP is a government tax authority, not an ICT third-party service provider to financial firms. The connection is data-driven fraud, not supply-chain dependency. ## 3\. Technical analysis & attack chain ### Confirmed attack chain (per DGFiP statement and source reporting) 1. **Initial access — credential theft:** The attacker gained access to DGFiP systems "following identity theft" — DGFiP's term for stolen credentials. The source does not specify whether credentials were phished, purchased, or obtained via infostealer malware. The mechanism is unconfirmed beyond DGFiP's "identity theft" characterisation. 2. **MFA bypass:** ZeroBytes claimed to have used "an MFA bypass technique" to defeat multi-factor authentication. The specific technique is not described in the source — no mention of session-token theft, MFA fatigue/prompt bombing, SIM-swap, or reverse-proxy phishing kits. This claim is single-sourced (the attacker's forum post) and unverified by DGFiP's statement, which does not confirm or deny the MFA bypass detail. 3. **Data consultation and exfiltration:** DGFiP confirmed the access "allowed the consultation and extraction of data concerning individuals and professionals." The volume, schema, and sensitivity of extracted data are not yet confirmed — DGFiP stated "in-depth investigations are ongoing to determine precisely which data and number of users were affected." ZeroBytes claimed 2 million taxpayer records; this is unverified. 4. **Access severance:** DGFiP stated the unauthorised access "had been severed at the end of June as part of an audit" — meaning the attacker's access was cut before the forum advertisement on 2026-08-12, not in response to it. DGFiP disputes ZeroBytes' claim of retained access. 5. **Post-discovery containment:** Following the forum advertisement and a filed complaint, DGFiP "immediately implemented new restrictions to stop the unauthorized access and prevent further unauthorized use." The nature of these restrictions is not specified. ### Unconfirmed claims (single-sourced to attacker forum post) - Database contains 2 million French taxpayer records — unverified. - ZeroBytes retains ongoing access to DGFiP systems — disputed by DGFiP. - The MFA bypass technique detail — not corroborated by DGFiP's statement. **Attribution caveat:** "ZeroBytes" has no MITRE ATT&CK profile in verified reference data. Attribution is based solely on the forum alias used in the advertisement. Treat as unconfirmed. **Contextual pattern:** This incident is part of a documented series of 2026 breaches affecting French public-sector entities: - **February 2026:** Ministry of Finance — stolen credentials, 1.2 million records containing bank details. - **March 2026:** Health Ministry / Cegedim Santé — 15.8 million administrative files stolen. - **April 2026:** France Titres — alleged attacker was a 15-year-old; 18–19 million people affected. - **June 2026:** Tchap (government encrypted messaging) — suspected breach, 73,000 user accounts, 643,000 messages, \~60,000 media files. The repeated use of stolen credentials across these incidents suggests a systemic credential-hygiene or identity-protection gap in French public-sector infrastructure. Financial institutions should assume that cumulative exfiltrated data from these incidents is available to fraud actors. ## 4\. Mitigation & containment ### P1 — Within 24 hours - **Fraud operations alert:** Notify fraud, AML, and customer-protection teams that a large volume of French taxpayer data (potentially including names, fiscal identifiers, and professional status) may be circulating in cybercrime markets. Instruct front-line and call-centre staff to be alert for socially engineered account changes referencing taxpayer or fiscal information as verification. - **Credential monitoring:** If your institution maintains any integration, data exchange, or SSO federation with DGFiP or French public-sector systems, audit authentication logs for the period 2026-06-01 through 2026-06-30 for anomalous sessions, new device registrations, or credential reuse patterns. - **Threat-intelligence pivot:** Task your TIP / CTI team to monitor cybercrime forums for the advertised database and any follow-on sales of DGFiP access. Single-sourced; verify before enforcement. ### P2 — Within 72 hours - **Customer-facing advisory:** Consider a proactive communication to French-resident retail and corporate customers warning of potential impersonation attempts using stolen government data. Emphasise that the institution will never request full credentials or MFA codes by phone or email. - **Authentication hardening review:** Given the claimed MFA bypass, review MFA implementation resilience — specifically: enforce number-matching prompts (not push-only), implement session-token binding and replay detection, and consider phishing-resistant MFA (FIDO2/WebAuthn) for high-risk roles. - **Transaction monitoring tuning:** Adjust anomaly-detection rules for French accounts: flag new payee additions, changes to direct-debit mandates, and profile changes (address, phone, email) occurring within 30 days of a customer-initiated tax-related interaction. ### P3 — Within 7 days - **Tabletop exercise:** Run a scenario-based exercise simulating mass credential-stuffing or account-takeover driven by government-exfiltrated PII, incorporating lessons from the February 2026 Ministry of Finance breach (bank details stolen) and this DGFiP incident. - **Information-sharing:** Share relevant observations with FS-ISAC and national CSIRT (ANSSI for French operations) if your institution detects fraud attributable to this data. ## 5\. Indicators of compromise No atomic indicators of compromise (IPs, domains, hashes, file paths, registry keys) are present in the source material. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | | Forum advertisement of a DGFiP taxpayer database (\~2M records) by alias "ZeroBytes" | Cybercrime forum monitoring / dark-web intelligence feeds | Medium — single-sourced to the source report; forum name not specified | | Claim of ongoing access to DGFiP systems offered for sale | Cybercrime forum monitoring | Low — disputed by DGFiP; single-sourced to attacker claim | | Credential-based access to government systems using stolen identities followed by MFA bypass | Authentication logs, IAM/IdP telemetry, EDR on government-facing integration endpoints | Medium — confirmed by DGFiP for the access method; MFA bypass technique unspecified | | Spike in socially engineered fraud calls/transactions referencing French taxpayer or fiscal data | Call-centre QA systems, fraud case management, transaction monitoring | Low — predictive, not yet observed | ## 6\. Detection Insufficient indicators to author detection rules. The source material provides no file hashes, distinctive strings, command-line artefacts, mutex names, registry keys, network indicators, or log signatures attributable to the threat itself. The alias "ZeroBytes" is an actor name, not a threat artefact, and is not suitable for a YARA or Sigma rule. ## 7\. Sources - The Register, "French tax authority admits data heist after crook touts 2M records," https://www.theregister.com/security/2026/08/14/french-tax-authority-admits-data-heist-after-crook-touts-2m-records/5287885, 2026-08-14 ## 8\. Adverse Trace position This is a confirmed data-exfiltration incident at a national tax authority, not a vulnerability disclosure or malware campaign — there is no CVE, CVSS, or CISA-KEV entry to assess. The operational risk to EMEA financial services is downstream: stolen taxpayer PII is a high-value enabler for social engineering, synthetic-identity fraud, and targeted account-takeover. The cumulative effect of five separate French public-sector breaches in 2026 (Ministry of Finance, Health Ministry/Cegedim, France Titres, Tchap, and now DGFiP) means a substantial corpus of French citizen PII is likely available to fraud actors. Attribution to "ZeroBytes" is unconfirmed — no MITRE ATT&CK profile exists, and the actor's claims (record count, retained access, MFA bypass) are single-sourced and partially disputed by DGFiP. We are monitoring cybercrime forums for the advertised dataset and any follow-on access sales, and will update clients if corroborated IOCs emerge. Clients with French retail or corporate exposure should treat this as a fraud-prevention trigger, not a patch-and-contain event. --- [Read the original source →](https://www.theregister.com/security/2026/08/14/french-tax-authority-admits-data-heist-after-crook-touts-2m-records/5287885?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*