Hacking of the DGFiP: tax data of 678,000 households exfiltrated

Nearly seven weeks of silence before the confession. On August 13, the Ministry of the Economy confirmed fraudulent access to the information system of the DGFiP, the general directorate of public finances. A hacker presenting himself under the pseudonym ZeroBytes claims to have extracted the tax data of 678,000 individuals and professionals. The file falls while France remains the country most affected in the world by physical attacks targeting cryptocurrency holders

What the file stolen from the DGFiP really contains

According to the press release from the Ministry of the Economy, the intrusion dates back to June 26. The hacker allegedly impersonated an agent with legitimate access, before using an internal search tool to suck up data in bursts. A routine check cut off this access the same month, too late to prevent exfiltration.

The claimed lot includes 392,867 individual accounts and 285,570 professional accounts, with names, dates of birth, addresses, family situation, reference tax income and withholding tax rate.

In total, 678,438 lines. Enough to construct a false message from the tax administration that is much more credible than a generic email. ZeroBytes also claims a second base, this time cadastral, covering more than two million people. The DGFiP has so far neither confirmed nor denied it.

A tax file, a boon for crypto robbers

Real estate assets and reference income are enough to identify a wealthy target. France already concentrates most of the wrench attacks, these attacks where the victim is forced under the threat of transferring their cryptocurrencies. The figure is clear. 33 cases out of 52 recorded worldwide in the first half according to CertiK, 30 out of 46 according to Chainalysis, for more than 30 million dollars stolen.

Jameson Lopp, head of security at Casa, summed up on X: “More bad news for bitcoin holders who live in the number one country for wrench attacks. The French tax authorities were hacked, and 678,000 files were leaked. »

A couple without any wallet (digital wallet) recently paid a high price for the tax history of their own home, targeted in place of the former owner.

DGFiP and FICOBA, an administration which multiplies leaks

The ministry confirms the intrusion without yet validating the figure of 678,000 people. Investigations are continuing with ANSSI and the senior defense and security official, the CNIL will be notified and a complaint must be filed. However, this is not the first time that the DGFiP has served as a gateway to massive data theft. Already in February, the FICOBA banking file had exposed 1.2 million accounts, RIB and tax numbers included. Two leaks in six months, on two separate systems of the same administration. A coincidence would almost begin to resemble a structural flaw.