Anssi concludes that data theft at the DGFiP results from weaknesses, not a sophisticated attack

The thefts of personal data hosted by the tax authorities, which occurred this summer, are “not the consequence of a sophisticated attack”, established the National Information Systems Security Agency (Anssi) in an incident report published Tuesday September 29. According to the national cybersecurity authority, these data thefts were based on “exploitation of weaknesses” within computer systems.

Claimed in August by a computer hacker, a first theft, which occurred several weeks earlier, was recognized the next day by Bercy. A second theft was claimed, before a third was identified. In total, the personal data of nearly 700,000 individuals and companies were stolen by attackers who penetrated the information systems of the General Directorate of Public Finances (DGFiP). “None of these exfiltrations were detected, neither by the supervision means of the DGFiP nor by those of Anssi, revealing certain gaps in the supervision of the DGFiP’s information systems,” wrote Anssi.

Skip the ad

A “full audit”

According to the authority's findings, the malicious actor who claimed responsibility for the attack, ZeroBytes, managed to connect to DGFiP services using legitimate credentials stolen from certain agents. Anssi indicates that only a “complete audit”, ordered in August by Prime Minister Sébastien Lecornu, will make it possible to identify all of the DGFiP’s IT vulnerabilities. It nevertheless makes several recommendations.

Anssi thus evokes the generalization of multi-factor authentication, which prevents you from connecting using a single password by additionally requiring a second validation. It also recommends prohibiting connection to professional services from personal devices, and using passwords that respect “good security practices”.

After the data thefts at the DGFiP, Sébastien Lecornu indicated that “few ministries are at the required level” in France in terms of cybersecurity. At the beginning of September, after the arrest of two individuals suspected of being tax pirates, one of them, aged 18, was indicted and placed in pre-trial detention.