France’s Directorate General of Public Finances exposes tax and business data of 678,000 individuals and professionals in France

France’s Ministry of Economy and Finance confirmed a major DGFiP data breach affecting around 678,000 individuals and businesses. Attackers accessed and extracted data using compromised credentials belonging to a DGFiP employee and an authorised third party.

France’s Ministry of Economy and Finance has confirmed a major data breach affecting information held by the Directorate General of Public Finances (DGFiP). Investigations found that data relating to approximately 678,000 individuals and businesses was accessed and extracted after attackers used compromised credentials belonging to a DGFiP employee and an authorized third party.

The Ministry outlined that taxpayers’ online accounts, usernames and passwords were not compromised, but more effective controls will be performed.

The unauthorized access took place during June and July 2026, although a malicious actor publicly claimed access to DGFiP systems on 12 and 13 August 2026.

According to the Ministry, the attackers gained access by using compromised credentials associated with a DGFiP employee and an authorised third party. DGFiP disabled the affected accounts once the intrusions were detected.

Initial security checks did not show that information had already been extracted. However, further investigation established that data concerning around 678,000 individuals and professionals had been viewed and extracted. The Ministry indicated that the attack was sufficiently sophisticated that the extraction was not immediately identified.

For individuals, the compromised information included:

• reference taxable income;
• family quotient information; and
• withholding-tax rates.

For businesses and professionals, the affected information included:

• company names; and
• SIREN identification numbers.

Certain cadastral information, including addresses and property surface areas, was also accessed.

Importantly, DGFiP confirmed that personal and professional accounts on the public tax portal were not compromised. Taxpayer and business usernames and passwords were also not obtained through the incident.

Following the discovery of the breach, DGFiP notified the French data-protection authority, CNIL, restricted access to sensitive information systems and introduced additional security measures. The investigation is continuing together with the relevant cybersecurity authorities, while affected individuals and businesses are being contacted individually.

The authorities have not identified France’s electronic invoicing infrastructure or approved-platform network as the source of the incident. Therefore, the incident should not be described as a breach of the French e-invoicing system.

Nevertheless, the case highlights the importance of strong security controls around digital tax systems, particularly where employees and authorised third parties have access to sensitive taxpayer information.

Implementation impact and what businesses should do:

The DGFiP breach does not currently introduce new fiscalization, e-invoicing or tax-reporting requirements for businesses, and there is no indication that France’s upcoming e-invoicing system itself was compromised.

However, businesses operating in France should consider the incident as an important cybersecurity warning. Companies should strengthen credential management, review employee and third-party access rights, monitor access to tax and financial systems, and ensure that compromised accounts can be identified and disabled quickly.

Businesses contacted by DGFiP regarding the breach should also follow the authority’s instructions and remain particularly alert to phishing, impersonation or fraudulent communications that could use the exposed company or tax-related information.

Overall, no immediate system implementation change is required, but businesses should use the incident to review access controls and cybersecurity safeguards around tax, accounting, fiscalization and e-invoicing environments.

An official source can be found on the portal of the French Finance Ministry. Source

Nikolina Basić, Senior Legal Consultant at Fiscal Solutions