Cyberattack on French tax system exposes personal data of 678,000 users

French prosecutors have opened an investigation into a major cyberattack on the country’s tax administration that compromised the personal data of nearly 700,000 individuals and businesses.

The cybercrime unit of the Paris Public Prosecutor’s Office is investigating the fraudulent extraction of data, which tax officials described as more sophisticated than previous incidents, French RFI reported.

Prosecutors said the investigation also covers suspected participation in a criminal conspiracy aimed at preparing an offence punishable by at least five years in prison.

The attack allowed hackers to extract data relating to 678,000 users of France’s tax system, including private individuals and companies.

Tax authorities said the incident was more complex than cyberattacks they had faced in the past, potentially raising fresh concerns about the security of government information systems following a series of recent breaches involving other French public bodies.

For individual taxpayers, the stolen information included full names, family quotient details, reference taxable income and withholding tax rates, according to Amélie Verdier, Director-General of Public Finances.

However, the Directorate-General of Public Finances, or DGFiP, stressed that the stolen information does not provide access to taxpayers’ secure accounts on the impots.gouv.fr website.

Officials said affected individuals would be contacted from early next week, with authorities particularly warning them about the potential risk of identity theft and fraudulent attempts to obtain additional personal information.

For businesses, the information exposed was considered less sensitive, Verdier said.

It included details such as a company’s SIREN registration number, business address and the address of its authorised representative.

Growing cyber threat to French institutions

The incident comes after a number of cyberattacks targeting French public institutions in recent weeks, including systems linked to the National Agency for Secure Documents, known as ANTS, and the national statistics agency INSEE.

French media have speculated that the latest breach is likely to increase scrutiny of the measures used to protect state-held data, particularly as cybercriminals increasingly target public administrations and databases containing large quantities of personal information.

By Nazrin Sadigova