France's Tax Agency Faces Second Breach Claim in Three Days

France's tax administration has now been breached twice by the same attacker, and the second job looks considerably wider than the one the agency confirmed yesterday. The Direction generale des Finances publiques acknowledged on August 13 that someone extracted 678,438 rows of tax data after spoofing an identity in late June. Early this morning a second claim surfaced, dated July 29, against the agency's cadastral server: 252,149 rows covering 2,041,778 property holders. The DGFiP has confirmed the first intrusion. It has not confirmed the second.

• Two separate intrusions, one actor. A person using the handle ZeroBytes claimed the tax-data breach on a criminal forum on August 12 and the cadastral breach on August 14.
• The June haul is granular. Among 678,437 people, 392,867 are individuals and 285,570 are professionals. 26,805 have a reference tax income of 100,000 euros or more, 386 clear 1 million, and 8 clear 10 million.
• The July haul links people to property. Names, civil status, holder addresses, parcel identifiers and cadastral sections, which is enough to tie an individual to a specific piece of French real estate.
• Neither was a database dump. Both hit internal lookup tools through what looked like authorised access, which is why the extraction ran for weeks without tripping anything.

What did the attacker actually take?

The June intrusion targeted an internal search tool the tax administration uses to pull records on individuals and businesses. The exposed fields go well past name and address: internal tax identifiers, dates and places of birth, family composition, number of dependents, reference tax income, withholding tax rate, phone numbers, email addresses, and logs of the requests each person had filed with the administration. That last field is unusual and worth pausing on. It means the leak includes not just what the state knows about you, but what you asked the state about.

RelatedvCenter's 9.8 Flaw Was Exploited Five Days After Disclosure

The July claim is a different system entirely. The target was the domain apexappliext.dgfip.finances.gouv.fr, which fronts the Serveur Professionnel de Donnees Cadastrales, the professional-facing cadastral data server. Cadastral records map ownership to land. The 252,149 extracted rows resolve to 2,041,778 people because a single parcel can carry several title holders, so the row count badly understates the human count. ZeroBytes claims the same access path reached data on roughly 20 million citizens and that a full extraction would have taken months at the rate the tool returned results.

Why does a lookup tool leak more quietly than a database?

This is the part most of the coverage skips, and it is the part that actually matters for anyone defending a similar system. A classic exfiltration shows up as an anomaly: a large transfer, an unusual export, a query no application would ever issue. Security teams build detection around exactly that shape.

What happened here has no such shape. The attacker held a valid account and, in the July case, got past multi-factor authentication, then used the tool the way a civil servant uses it. Search a name. Read the result. Search the next one. Every individual request is legitimate. The abuse only becomes visible in aggregate, and only if someone is watching per-account query volume over time rather than watching for a big transfer.

That is also why the attacker's own account of the July intrusion is credible when he says a complete extraction would have taken months. He was not copying a table. He was draining it through a straw, and the straw's diameter was set by the application, not by him. The 252,149 rows he did pull represent what a patient adversary gets in roughly two weeks of that.

1. Jun 26, 2026First intrusion, via identity spoofing Internal search tool for individuals and professionals
2. Jul 29, 2026Second intrusion claimed, cadastral server Valid account plus MFA bypass on apexappliext.dgfip.finances.gouv.fr
3. Aug 12, 2026Tax data listed on a criminal forum 678,438 rows offered by the handle ZeroBytes
4. Aug 13, 2026DGFiP confirms the June access CNIL notified, ANSSI and the SHFDS engaged
5. Aug 14, 2026Second claim surfaces 252,149 rows, 2,041,778 property holders, unconfirmed

How do the two incidents compare?

Who is exposed, and how badly?

The two datasets are more dangerous together than apart, which is the risk nobody has priced in yet. The June file tells you what someone earns, how many dependents they have, and how to contact them. The July file tells you what they own and where it sits. Cross-referenced on name and date of birth, that produces a targeting list for fraud that no commercial data broker could assemble legally.

The income tail makes it sharper. 26,805 people in the tax file report 100,000 euros or more, 386 report over 1 million, and 8 report over 10 million. Pair a verified high-income record with a verified property holding and you have the input for convincing impersonation of the tax office itself, which is the scam French taxpayers are most conditioned to take seriously. Anyone in these files should expect approaches that quote real, correct details back at them.

Professionals carry a second problem. 285,570 of the June records are businesses, and business tax identifiers plus turnover-adjacent figures are exactly what invoice-redirection fraud runs on.

Why did five weeks pass before anyone noticed?

The June access was detected and confirmed in August. The July access was still unconfirmed as of this morning, two weeks after it allegedly happened and two days after the same actor proved he was not bluffing about the first one. The gap is the finding.

RelatedValve warns Steam hardware buyers of CEVA data breach

The DGFiP says it immediately put new restriction measures in place once alerted, that its information systems teams are working with the ministries' senior defence and security official and with ANSSI, and that the CNIL has been notified as the law requires. Read carefully, that describes a response triggered by a public claim rather than by internal detection. When your alerting is downstream of a criminal forum listing, your dwell time is set by how long the attacker feels like waiting before he advertises.

Our take

The headline number will keep moving, and chasing it is the wrong instinct. The durable lesson sits in the access pattern. Two intrusions, five weeks apart, both through front doors that were open to a legitimate-looking session, both invisible until the attacker chose to announce them. Multi-factor authentication was present on the July target and did not hold. Perimeter controls did their job and were simply not the relevant control.

What would have caught this is unglamorous: per-account rate limiting on internal lookup tools, and alerting on a single session querying thousands of unrelated citizens. Those controls are cheap and they are boring and almost nobody funds them, because they protect against an insider-shaped threat rather than a hacker-shaped one. The DGFiP just demonstrated, twice, that the distinction stopped being useful.

For anyone running a similar system, the question worth asking this week is not whether your authentication is strong. It is whether you would know if one valid account read two million records slowly.

Original analysis by GenZTech, built from the DGFiP's own statement and the two published claim analyses. Reporting detail on the cadastral intrusion via cyberattaque.org.