Valid logins, an MFA bypass, and 678,000 records: the French tax breach

On August 17, 2026, France’s Ministry of the Economy and Finance disclosed that an attacker had reached systems at the Direction générale des Finances publiques (DGFiP), the country’s tax administration, and pulled data on 678,000 individuals and businesses. According to public reporting from outlets including BleepingComputer, Help Net Security, and eSecurity Planet, the material included reference tax income, family quotient, withholding tax rate, company names and SIREN identifiers, and cadastral data covering addresses and property sizes. The ministry said the public-facing tax portals were not compromised and that taxpayer usernames and passwords were not exposed.

The reported entry path is the part worth sitting with. Public reporting indicates the intrusion ran through June and July 2026 using the credentials of a tax office employee and of an external contractor, together with a technique that defeated multi-factor authentication. DGFiP said it suspended the accounts on detecting the intrusions, and that the sophistication of the activity meant its initial access review did not reveal the extent of the data theft. An in-depth investigation began on August 12, the same day an actor using the alias ZeroBytes listed a stolen database for sale on a cybercrime forum. That actor also claimed access to a portal holding records on roughly 20 million people and said only 252,149 records were extracted; those figures are the attacker’s own and have not been independently verified. CNIL was notified and ANSSI is assisting.

There is no exploit chain to dissect here in the usual sense. Two accounts that were supposed to exist logged in, and a second factor that was supposed to stop an impostor did not. From that point forward, every control downstream of identity saw an authorized user doing something the account was permitted to do. Multi-factor authentication answers one question, whether the person at the keyboard is who the directory thinks they are, and it answers that question once, at the door.

What it cannot answer is how much a legitimate session should be allowed to touch. A caseworker who looks up a taxpayer record is doing the job. A contractor account that reaches hundreds of thousands of records across departments and property registries is doing something no role description covers. Attribute-based access control draws that boundary where it can actually be enforced, at the data itself, per user and per operation, so that a stolen credential inherits a job rather than a jurisdiction.

When extortion involves encryption, there is a moment of unmistakable noise: files rewritten at machine speed, extensions changed, notes dropped in directories. This incident produced no such moment. The damage was done by reading, at a volume and a breadth that no single human workflow generates, spread over weeks rather than minutes.

That pattern is invisible to a system that only checks whether each individual request is permitted, because each individual request was. It is highly visible to a system that models what normal looks like for this account, this host, and this dataset, and then measures live activity against it. Bulk-read detection on production data is not a nice-to-have alongside identity controls; it is the control that catches what identity controls structurally cannot, whether the records sit in an application database or in the documents, exports, and reports that accumulate on file shares reachable over SMB, NFS, S3, and Web Drive.

The sequence reported here should be uncomfortable for anyone responsible for sensitive records. The agency detected intrusions and cut off the accounts. The scale of what had been taken became clear later, when someone tried to sell it. Between those two events sits the gap that defines modern breach response: knowing that access happened is not the same as knowing what left.

Closing that gap is a matter of evidence. A per-operation, tamper-resistant audit trail that records which identity read which object, when, and from where turns a scoping exercise into a query instead of a reconstruction. It is what lets an organization notify precisely rather than broadly, and what lets it say with confidence that a criminal’s claim about twenty million people is or is not supported by what the systems actually recorded.

None of this is a criticism of the responders. DGFiP suspended the accounts, engaged the national cybersecurity agency, and disclosed. The architectural point is that the decisive window opened the moment two valid credentials started reading at scale, and it closed long before anyone had reason to look. Defending that window means putting least privilege and behavioral analysis on the data, because that is where the attack was, and that is where it was quiet.