French tax authority breach hits 678,000 records
Income, family quotient and withholding rates were extracted through access points the ministry has since closed.
2 minEnterprise CyberSec
France's Directorate General of Public Finances has confirmed that an attacker reached data on 678,000 individuals and businesses. The ministry's statement describes access points used to consult and extract tax data including reference income, family quotient and withholding tax rate.
The exposed set also covers business names and SIREN identifiers, plus cadastral data with addresses and property sizes. User identifiers and passwords were not taken.
The timing is the uncomfortable part
The breach was discovered on 12 August. The same day, an actor using the handle ZeroBytes listed the database for sale on a hacking forum. Discovery and public listing therefore coincided, which usually means the seller moved first and the notification followed.
A second claim sits alongside the confirmed figure and should be read carefully. The attacker says they also reached a cadastral database covering roughly 20 million French citizens, but claims to have extracted 252,149 records from it. The larger number describes access, not exfiltration, and the two are being reported together.
CNIL has been notified and ANSSI is involved in the investigation. Affected people were due to be contacted from the following week.
For anyone assessing exposure, the fields matter more than the count. Reference income and withholding rate are the inputs to a convincing impersonation of a tax authority, and unlike a password they cannot be rotated.
Retold from BleepingComputer. This is a summary in our own words; follow the link for the original reporting.