Compromises at the DGFiP: "It Happens Several Times a Week"

The DGFiP acknowledges a "sophisticated" attack

Data leaks affecting French public administrations and organizations are no longer isolated incidents. They are now occurring at a rapid pace, sometimes several times within a few days. After France Travail, the ANTS, and Bloctel, the General Directorate of Public Finances (DGFiP) is now facing a series of intrusions.

The Director General of Public Finances, Amélie Verdier, has acknowledged the extent of the illegitimate access to the DGFiP's information system. "We apologize to all affected users," she stated, referring to an attack "more sophisticated than what we have seen in the past." The attacker reportedly did not carry out "massive querying," which is generally easier to detect.

The intrusions, which occurred in June and July, were based on the impersonation of the credentials of a DGFiP agent and an authorized third party. In total, 678,000 individuals and professionals are affected. For individuals, the exposed information includes names, family quotient, reference tax income, and withholding tax rates.

However, the DGFiP assures that the website impots.gouv.fr and taxpayers' personal spaces have not been compromised.

But in the meantime, a cybercriminal has claimed another intrusion, this time concerning the cadastral data of over 2 million French property owners. Names, dates of birth, and addresses are reportedly involved.

"The State is putting us in serious danger"

For Alexandre Stachtchenko, a prominent figure in the French Bitcoin ecosystem, the issue goes far beyond just the DGFiP.
The tax office. France Travail. The cadastre. The ANTS. Bloctel... The State is putting us in serious danger. Enough is enough.
Alexandre Stachtchenko, Head of Strategy & Communications Bitstack.

In a LinkedIn post, he reminds that this new case constitutes the third intrusion targeting the tax office in seven months, following the compromise of FICOBA in January, which involved 1.2 million accounts. Additionally, there is France Travail with 36.8 million people affected, 19 million ANTS records offered for sale, and up to 3 million numbers associated with Bloctel.

Stachtchenko directly addresses public authorities.
How many leaks before a simple MFA on such sensitive files?
Alexandre Stachtchenko, Head of Strategy & Communications Bitstack.

He also worries about the day when biometric data may be compromised: "An address is very annoying, but it can be changed. A face, fingerprints, cannot."

His observation is even more alarming for cryptocurrency holders. "France exceeds 50 kidnappings and crypto assaults," he recalls, also highlighting that a tax agent under investigation has admitted to selling addresses of holders to criminals.

The risk indeed lies in the cross-referencing of different databases: an address from a leak can be associated with a tax income from another, then to a phone number, a date of birth, or other information obtained elsewhere.

Raphaël Grably, a journalist specializing in cyber issues at BFMTV, also regularly alerts about this multiplication of compromises. In a post on X, he highlights a new episode in this series of hacks, illustrating how close together the announcements of leaks are now.

Late discovery of intrusions

The DGFiP indicates that it notified the CNIL as soon as the data thefts were identified on August 12, while the intrusions date back to June and July. The administration justifies this delay by the sophistication of the attack.

This point is particularly criticized by Alexandre Stachtchenko, who notes the gap between the intrusion and its public communication. He now demands a "moratorium" on new data collections.
Not one more collection until the State knows how to keep what it has.
Alexandre Stachtchenko, Head of Strategy & Communications Bitstack.

The Paris prosecutor's office has opened an investigation, and an interministerial crisis unit has been convened. The DGFiP also announces additional security measures in collaboration with the ANSSI.

In the face of compromises that are now occurring several times a week, the problem goes beyond just the tax office. It is now a question of the State's ability to protect, compartmentalize, and monitor access to the vast volumes of personal data it holds.