France Tax Agency Data Breach 2026: DGFiP Hack Explained

On August 12, 2026, a hacker using the alias ZeroBytes posted on a dark-web forum specializing in stolen data, claiming to have breached the systems of France's DGFiP (Direction générale des Finances publiques), the agency that runs the French tax portal impots.gouv.fr, roughly France's equivalent of the US IRS or UK HMRC. On August 13, France's Ministry of Economy confirmed unauthorized access to the DGFiP's information system. Sources: French Ministry of Economy, iPhoneSoft.

According to the hacker and samples reviewed by French tech press, the exposed data includes names, addresses, phone numbers, reference taxable income, and withholding tax rates. No banking details or account passwords have been reported in the leaked samples. Sources: KultureGeek, univers-simu.com.

The hacker, ZeroBytes, claims 678,438 lines of data were stolen. That figure comes from the hacker's own claim and has not been independently line-by-line confirmed by the DGFiP as of publication; officials say an investigation with ANSSI, France's cybersecurity agency, is still working to determine the full scope. Sources: French Ministry of Economy, frenchbreaches.com.

According to the ministry, the unauthorized access dates back to late June 2026, achieved through identity theft of internal credentials, weeks before the public claim on August 12. The hacker says they infiltrated several servers before gaining access to a VPN that opened up internal DGFiP tools. Sources: French Ministry of Economy, iPhoneSoft.

Yes. Between January and February 2026, diverted staff credentials already enabled fraudulent access to 1.2 million bank accounts through FICOBA, the French national register of bank accounts. This August incident is the second major breach affecting the French tax administration in 2026. Sources: French Ministry of Economy.

The DGFiP says affected individuals will receive an individual notification detailing which of their data was compromised. There is no reliable way to self-check online before receiving that notice; be wary of any third-party site claiming to let you check your exposure, which is itself a common phishing tactic. Sources: French Ministry of Economy.

The main risk is targeted phishing: genuine tax details (income, withholding rate) let scammers craft highly convincing messages impersonating the DGFiP. French officials stress the tax administration never asks for bank details, passwords, or card codes by email, text, or phone. Sources: French Ministry of Economy.

The DGFiP has put new access restrictions in place to prevent further intrusions, is notifying the CNIL (France's data protection authority) as required under GDPR, is filing a criminal complaint, and is working with ANSSI, France's national cybersecurity agency, to determine the exact scope of the breach. Further updates are expected as the investigation progresses. Sources: French Ministry of Economy.

As a precaution, yes, especially if you reuse that password elsewhere. There is no public indication that login passwords themselves were compromised (the claimed data is tax and identity information, not login credentials), but changing your password and enabling two-factor authentication if available is good general security practice.