# ZeroBytes Breaches French Tax Authority (DGFiP): Stolen Credentials and MFA Bypass Expose Tax Data of 678,438 Taxpayers and Businesses

> In late June 2026, a threat actor using the alias 'ZeroBytes' used stolen credentials and an MFA bypass on the SPDC (Serveur Professionnel de Données Cadastrales) cadastral platform to access France's Direction Générale des Finances Publiques (DGFiP), extracting fiscal and identity records for 678,438 individuals and businesses before the intrusion was severed during a routine security audit. ZeroBytes publicly advertised the data on a cybercrime forum on August 12, 2026, claiming over 2 million records and offering continued system access for sale; DGFiP confirmed the breach on August 13-14, and the Paris Public Prosecutor's cybercrime unit (via OFAC) opened a criminal investigation.

- **Published:** 2026-08-16T00:00:00Z
- **Last reviewed:** 2026-08-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2026
- **ID:** TL-2026-2026
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Actor:** ZeroBytes
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

France's tax administration (DGFiP), part of the Ministry of Economy and Finance, suffered an unauthorized access incident in late June 2026 that DGFiP itself described as more complex than prior attacks it had faced. According to DGFiP's own account, the access followed 'usurpation d'identité' (identity theft) and allowed the intruder to consult and extract data belonging to individuals and businesses; the access was cut off at the end of June 2026 during a routine internal audit. The threat actor's own account, given in an August 15 interview with the breach-tracking outlet FrenchBreaches, adds technical detail DGFiP did not confirm: ZeroBytes says the access chain used stolen credentials belonging to a DGFiP tax agent ('agent de la DGFiP') and an authorized third party ('tiers habilité'), connected via the agency VPN, and bypassed multi-factor authentication protecting the SPDC — the Serveur Professionnel de Données Cadastrales (Professional Cadastral Data Server), DGFiP's cadastral (property-registry) subsystem, reachable via the internal application host apexappliext.dgfip.finances.gouv.fr. From there, ZeroBytes accessed an internal search/export tool named 'Suivi des demandes par usager' (User Request Tracking) — an environment the actor claims contains 6,366,056 fiscal requests addressed to tax services — and used it to pull taxpayer and property-owner records. The actor states extraction activity continued into July 2026 and included an automated component, but that the automated retrieval was voluntarily throttled and ultimately halted because the pace was too slow to exhaustively harvest the environment within a reasonable time.

DGFiP confirmed 678,438 total records exposed — 392,867 individual taxpayer accounts and 285,570 professional/business accounts — spanning names, dates of birth, postal addresses, email addresses, phone numbers, family/dependent status, tax reference income, and source-withholding tax rates, plus internal fiscal-request administrative history (dates and subjects of prior contacts with tax services). Business records additionally include SIREN registration numbers, business addresses, and authorized-representative contact details. DGFiP disclosed that 26,805 exposed individuals report income over €100,000, 386 over €1 million, and 8 over €10 million, making the dataset attractive for targeted spear-phishing, business email compromise, and identity-fraud schemes. Critically, DGFiP states the stolen data does NOT grant access to taxpayers' secure impots.gouv.fr accounts, and no payment-card or banking-credential data was exposed.

ZeroBytes' claims exceed DGFiP's confirmed figures on two fronts. First, from the SPDC cadastral environment specifically, the actor claims 252,149 extracted lines corresponding to 2,041,778 individuals (multiple titleholders per parcel), including names, sex, birth date/place, addresses, MAJIC land-parcel identifiers, department/commune data, cadastral section and parcel numbers, property rights, and multi-titleholder associations — and asserts the underlying system could hold records on roughly 20 million citizens in total (an unconfirmed, cybercriminal-supplied estimate). Second, the actor claims to have retained ongoing access after the June cutoff and offers to sell continued access alongside the dataset. DGFiP disputes the retained-access claim, stating the access 'had been severed at the end of June as part of the audit' and that additional restrictions have since been implemented. The scale discrepancy (678k confirmed vs. 2M+/20M claimed) is unresolved as of publication and should be treated as an open question pending forensic confirmation — the technical account of the MFA-bypass mechanism, VPN specifics, and extraction tooling comes solely from the actor and is independently unverified.

ZeroBytes describes a financially motivated, opportunistic modus operandi ('un peu de tout: l'erreur humaine, les failles, la stupidité, le manque de sérieux' — human error, vulnerabilities, negligence), operating as a two-person team that sells stolen databases to third-party buyers without visibility into end use. The same alias has claimed responsibility for breaches at grocery chain Intermarché Drive, an entity referred to as 'EVA' (EVA GG), and the French Handball Federation (FFHandball), though FrenchBreaches notes the actor's documentation for those claims does not support the same level of precision as the DGFiP claim. This indicates a pattern of serial opportunistic intrusions against French organizations through 2026 rather than a single targeted DGFiP campaign.

Separately, several other French government-linked or government-adjacent systems suffered major 2026 breaches that source reporting explicitly frames as part of a wider pattern worth tracking for correlation: ANTS/France Titres (the national secure-identity-document agency), breached via an IDOR vulnerability by an actor using the alias 'breach3d,' with DGFiP confirming 11.7 million of an alleged 19 million exposed accounts (April 2026); INSEE (the national statistics agency), where an intrusion detected June 19, 2026 and confirmed June 26, 2026 exposed an internal staff directory of roughly 12,800 current/former employees (not the national census/statistical databases); and, most directly comparable in mechanism, the February 2026 FICOBA (Fichier des comptes bancaires) breach — also at the Ministry of Economy and Finance — in which a threat actor used stolen credentials belonging to a government official, exploiting a lapse in multi-factor authentication, to access the centralized French bank-account registry and expose roughly 1.2 million bank-account records. The FICOBA incident is the closest TTP match to the DGFiP breach (same ministry, stolen government-official credentials, MFA weakness) and should be treated as a directly relevant precedent for remediation scoping, not merely a loosely correlated headline. These incidents are attributed to different actors and are tracked as separate threats, but together form a corroborating pattern of credential/access-control failures across interconnected French public-sector finance and identity systems through 2026.

France's Economy Ministry confirmed the breach publicly on August 13-14, 2026, pledged to individually notify all 678,438 affected people/businesses starting the following Monday, and stated it would file a criminal complaint. The ministry said its investigation is being conducted in coordination with ANSSI (Agence nationale de la sécurité des systèmes d'information — France's national cybersecurity agency) and the SHFDS (Service du Haut Fonctionnaire de Défense et de Sécurité), the ministry's own high-defense-and-security-official function, to establish precisely which data were compromised and how access was obtained. The Paris Public Prosecutor's Office cybercrime unit opened a formal investigation, handled by OFAC (Office Anti-Cybercriminalité), France's national cybercrime-fighting office; CNIL (the French data protection authority) has been notified per breach-notification obligations. No CVE, malware family, or C2 infrastructure has been publicly disclosed — this is a credential/identity-based intrusion, not a software-vulnerability exploit.

## MITRE ATT&CK

- T1589.001 Credentials
- T1078 Valid Accounts
- T1133 External Remote Services
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1556.006 Multi-Factor Authentication
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1657 Financial Theft

## Sources

- [Sophisticated cyberattack exposes data of 678,000 French taxpayers](https://securityaffairs.com/197287/cyber-crime/sophisticated-cyberattack-exposes-data-of-678000-french-taxpayers.html)
- [France investigates tax authority breach after hacker claims 600,000 victims](https://therecord.media/french-tax-authority-dgfip-confirms-data-breach)
- [French tax authority admits data heist after crook touts 2M records](https://www.theregister.com/security/2026/08/14/french-tax-authority-admits-data-heist-after-crook-touts-2m-records/5287885)
- [DGFiP, Intermarché, EVA, handball : ZeroBytes sort du silence après une série de piratages en France](https://frenchbreaches.com/blog/dgfip-intermarche-eva-handball-zerobytes-sort-du-silence-apres-une-serie-de-piratages-en-france)
- [FrenchBreaches structured alert — DGFiP/SPDC cadastral dataset (252,149 lines / 2,041,778 individuals)](https://frenchbreaches.com/alertes/direction-g-n-rale-des-finances-publiques-spdc-mssm0kklrsqu9rd3vd)
- [FrenchBreaches structured alert — DGFiP taxpayer/business dataset (678,438 records)](https://frenchbreaches.com/alertes/direction-g-n-rale-des-finances-publiques-dgfip-msq5rgy4cql9o0l7cus)
- [Piratage DGFiP : un hacker dit avoir dérobé les données fiscales de plus de 670 000 Français, la DGFIP confirme](https://clubic.com/actualite-625210-piratage-dgfip-un-hacker-dit-avoir-derobe-les-donnees-fiscales-de-plus-de-670-000-francais.html)
- [French tax agency confirms breach as hacker claims 2 million victims](https://cyberinsider.com/french-tax-agency-confirms-breach-as-hacker-claims-2-million-victims/)
- [Nearly 700,000 French taxpayers' data stolen in cyberattack on tax authority](https://brusselssignal.eu/2026/08/nearly-700000-french-taxpayers-data-stolen-in-cyberattack-on-tax-authority/)
- [France: 680,000 Taxpayers Threatened After a Cyberattack Against the DGFiP](https://www.cointribune.com/en/france-680000-taxpayers-threatened-after-a-cyberattack-against-the-dgfip)
- [France's Tax Authority Confirms Late-June Data Breach After Hacker Advertises Stolen Records on Cybercrime Forum](https://fintech.garden/news/2026-08-14-frances-tax-authority-confirms-late-june-data-breach-after-hacker-advertises-sto/)
- [Cyberattack on French tax authorities (DGFiP) – theft of tax data](https://en.univers-simu.com/News/cyberattack-on-French-tax-authorities-(DGFIP)-%E2%80%93-theft-of-tax-data-125975/)
- [ANTS Hack: 19 million records exposed in French ID agency breach](https://cybernews.com/security/ants-hack-france-19-million-records-id-agency-breach/)
- [France confirms data breach at government agency that manages citizens' IDs](https://techcrunch.com/2026/04/22/france-confirms-data-breach-at-government-agency-that-manages-citizens-ids/)
- [INSEE Cyberattack Exposes Data on 12,800 French Statistics Staff](https://breached.company/insee-france-statistics-cyberattack-staff-data-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2026