France’s tax authority hit by third data breach

France’s tax authority has suffered a third data breach in as many months, raising fresh questions about the security of the country’s public databases.

The latest incident, discovered on Monday, August 17, involved an online service operated by the Direction Générale des Finances Publiques (DGFiP) dealing with inheritance. 

The DGFiP said the unauthorised access was quickly shut down. It has not yet disclosed how many people were affected or exactly what information was accessed.

The incident follows two much larger breaches at the French tax administration.

The first took place at the end of June and affected around 678,000 individuals and businesses, including approximately 350,000 individual taxpayers. 

The stolen information included names, dates of birth, addresses, telephone numbers, email addresses, family circumstances and tax-related information such as reference taxable income. 

A separate attack on the DGFiP's professional cadastral database potentially affected more than 430,000 individuals and more than 1,000 professionals, involving information linking people and businesses to property and land records.

The two earlier incidents alone therefore potentially involved more than 1.1 million people and entities.

This week’s breach involved data relating to successions vacantes: estates where no heir is known, where heirs have renounced an inheritance or where no heir has come forward within the required period. 

The tax authority hacks are not isolated cases, however. In recent months, French public bodies including the Education Ministry, France Titres and Urssaf have suffered cybersecurity incidents. 

The Urssaf breach, disclosed earlier this year, exposed data relating to around 12 million employees recruited over the previous three years.

This raises the question of why French public databases are such an attractive target for hackers, and whether France’s state apparatus is particularly vulnerable to cyberattacks compared with other countries.

The Connexion spoke to Arnault Barichella, associate research fellow specialising in cybersecurity and artificial intelligence at the Jacques Delors Institute and a researcher at Université Paris-Saclay.

The Connexion: Why is France being targeted by so many cyberattacks? 

Arnault Barichella: “France is regularly among the European countries with the highest number of cyberattacks. Even on a global scale, it tends to rank highly in terms of the number and volume of attacks, often just after the United States.

“Of course, it depends on the measure, the year and the metric but France is definitely one of the countries most affected by cyberattacks, both in Europe and globally. This is a reality that has increased over the past few years.

A highly centralised state

“One reason is linked to the way the French government functions. France is a very centralised country. This means that it offers a particularly attractive target for cyberattacks because compromising a single national administrative entity can potentially give attackers access to the data of millions of people at once.

“This is different from federal nations like Germany for example, which are much more decentralised. Their data is more regionalised, whereas France is highly centralised around Paris and the national administration.

Subcontractors can create weak links

“There is also the use of subcontractors. France increasingly works with private-sector entities, and these subcontractors can represent weak links because they tend to be less well protected than national agencies.

France has strong cybersecurity…but some gaps

“France also has some particular weaknesses despite its strong national cybersecurity capabilities. For example, double and multi-factor authentication is not as widespread as it should be. Experts have estimated that a majority of cyber attacks could have been avoided if stronger double or multi-factor authentication had been in place. 

“Finally, there is a regulatory issue. France is very effective at imposing severe financial sanctions on private-sector actors that fail to comply with cybersecurity rules, but the rules are less rigorous for public entities. This can create an imbalance.

“That does not mean France has a bad cybersecurity system. It has a very strong framework and one of the most robust in Europe, especially compared to other Member States. But it has certain weaknesses that help explain why it has become such an attractive target.”

The Connexion: How does France compare with the UK?

Arnault Barichella: “The UK is also heavily targeted, but it is much more decentralised than France. This high level of centralisation is a particular characteristic of the French system and culture.

Transparency can affect the figures

“There is also the issue of transparency. France has very high transparency requirements when it comes to reporting cyberattacks. This means that the figures can sometimes appear higher than in neighbouring countries because cyber incidents are more likely to be reported.

“The UK also has transparency requirements, but these tend to be less far-reaching as those in France. So the figures need to be interpreted carefully.

The Connexion: Why is French personal and administrative data so valuable to attackers?

Arnault Barichella: “It is not always about extracting money directly from someone. The issue is also linked to the nature of French administration and the country’s social system.

“French people have social security numbers, tax numbers and many other types of administrative identifiers. These types of records can be sold for a lot of money on the web and on the black market.

“I am not saying other countries do not have the same social identities, but French public administration tends to be more extensive than in many other nations. There are therefore more records and more identifiers that can be exploited.

France's geopolitical importance

“Lastly, there is also another major factor, which is geopolitical. France is the principal military power in the EU, in addition to being the only country in the EU with its own independent nuclear weapons capacity.

“This makes France particularly important from a strategic and geopolitical perspective. France is also a major military power in Europe and has a high degree of military independence. Russia, for example, has a strong interest in France, both because of its military role in Europe and its influence within the EU and NATO. fOr these reasons, France has traditionally been a major target.”