French judicial authorities have opened an investigation into a June cyberattack that resulted in the theft of tax data from 678,000 individuals and businesses, the Paris prosecutor's office said on Saturday.
The breach of the Directorate General of Public Finances (DGFIP) computer systems was only discovered this week. The investigation is being led by the French police cybercrime unit, Ofac, to determine how the intrusion occurred and whether an organized group was responsible.
Finance Minister David Amiel said a parallel audit led by the National Agency for Cybersecurity and Cyberdefense (ANSSI) would be conducted to draw lessons from the crisis. He said the findings would be submitted to the finance commissions of the National Assembly and the Senate.
Stolen data for sale
DGFIP head Amélie Verdier said on Friday that an intrusion into an agent's account was detected and contained in June. The agency initially believed no data was stolen, but realised the theft had occurred after a hacker boasted about the operation on Aug. 12.
The hacker, using the pseudonym ZeroBytes, obtained the full names, addresses, reference taxable incomes and applicable income tax rates of individual taxpayers, Verdier said. The data stolen for businesses was less sensitive, including addresses, administrative identification numbers and the names of those in charge.
Verdier said the hackers did not access information that would allow them to log into personal accounts or view full tax returns.
The alleged hacker claimed to have put the stolen file up for sale for several thousand euros.
Security overhaul
Amiel said on the social media platform X that cyberattacks targeting tax authorities and public services are proliferating. He said the threat will grow as artificial intelligence increases the means to carry out such attacks.
The state has accumulated certain technical debts and must respond quickly to accelerate the modernization of cybersecurity, Amiel added. This involves widespread implementation of two-factor authentication for public servants accessing files, early warning systems to detect data leaks, and a comprehensive review of all data access protocols.
The DGFIP will contact affected individuals from next week to explain the situation and provide guidance on how to protect against the data exposure.
The crime carries a minimum prison sentence of five years.
