French Tax Administration Data Breach Exposed Hundreds of Thousands of Records via Stolen Staff Credentials

In June and July 2026, an attacker gained unauthorized access to the systems of France's tax administration, the Direction Générale des Finances Publiques, using stolen credentials belonging to staff members. The intrusion remained undetected for seven weeks, according to a report published on Tuesday by ANSSI, the French National Cybersecurity Agency.

ANSSI's report, released in French on 29 September 2026, states that the method used was 'not sophisticated' and that the attack succeeded because of weak security controls. The agency noted that neither the tax administration nor ANSSI itself observed data leaving the network, though the incident resulted in access to tax data belonging to hundreds of thousands of taxpayers and businesses.

The exact nature of the stolen credentials and the specific vectors used to obtain them were not detailed in the available excerpt. ANSSI's assessment implies that improved credential hygiene, enforcement of multi-factor authentication, and enhanced monitoring of administrative accounts could have mitigated the intrusion. The report does not attribute the activity to a specific threat actor or nation-state.