French prosecutors have opened an investigation into a cyberattack on the country’s tax administration after data relating to 678,000 individuals and businesses was fraudulently extracted from a state-operated personal information system. Tax authorities described the incident as more complex than cyberattacks they had previously faced, raising fresh concerns over the security of government-held information.
The cybercrime unit of the Paris Public Prosecutor’s Office is investigating the breach, with the inquiry entrusted to France’s Office for the Fight against Cybercrime, known as Ofac. Prosecutors are also examining suspected participation in a criminal conspiracy aimed at preparing an offence punishable by at least five years in prison.
Personal and Tax Information Exposed
The stolen data relates to 678,000 users of France’s tax system, covering both private individuals and companies. For individual taxpayers, the compromised information included full names, family quotient details, reference taxable income and withholding tax rates, according to Amélie Verdier, Director-General of Public Finances.
The Directorate-General for Public Finances, or DGFiP, stressed that the information obtained in the attack does not provide access to taxpayers’ secure accounts on the Impots.gouv.fr website.
Affected taxpayers are expected to be contacted from early next week, with authorities particularly concerned about the possibility of identity theft and fraudulent attempts to obtain additional personal information.
Information exposed for businesses was considered less sensitive. It included details such as a company’s SIREN registration number, its business address and the address of its authorised representative.
Authorities Warn of Fraud Risks
Although the stolen information cannot by itself be used to access secure tax accounts, authorities warned that details such as income, tax rates and family circumstances could potentially be exploited to make fraudulent emails, messages or telephone calls appear more convincing.
Officials have sought to reassure taxpayers about the integrity of the tax platform while urging people affected by the breach to remain particularly cautious about attempts to obtain passwords, banking information or other sensitive details.
The incident follows several cyberattacks involving French public institutions in recent weeks, including systems linked to the National Agency for Secure Documents, known as ANTS, and the national statistics agency INSEE.
The latest breach is expected to increase scrutiny of measures used to protect state-held information as cybercriminals increasingly target public administrations and databases containing large quantities of personal data.
Government Seeks Stronger Security Measures
Public Accounts Minister David Amiel has asked the DGFiP to begin informing affected taxpayers as early as Monday. He has also requested proposals on how security procedures could be strengthened and what lessons should be drawn from what officials have described as an unprecedented attack on the tax authority.
The immediate priority is to ensure that people whose information was compromised know about the breach and remain alert to possible scams.
Investigators will now seek to establish how the attackers gained access to the tax administration’s systems, identify those responsible and determine whether the stolen information has been shared or used elsewhere.
