French tax data leak: victims will be informed this week

People affected by a major cyberattack on France’s tax administration are expected to be contacted from Monday, after personal data belonging to some 678,000 users was stolen.

The breach, which hit France’s tax authority, the Direction Générale des Finances Publiques (DGFiP), concerns the data of both individuals and businesses.

The DGFiP confirms the attack took place in July.

For individuals, the stolen information includes names, dates of birth, home addresses, telephone numbers, family circumstances, reference taxable income and withholding tax rates.

The same hacker group also claims to have stolen around 200,000 accounts reportedly containing cadastral information, relating to property and land ownership, during a previous attack in June.

The DGFiP stresses that the stolen information cannot be used to access secure taxpayer accounts on the impots.gouv.fr website, however the use of these personal details could make phishing attempts and identity theft considerably more convincing.

For businesses, the data taken is considered less sensitive and includes SIREN registration numbers, business addresses and the addresses of authorised representatives.

Affected taxpayers to be contacted

France’s Public Accounts Minister David Amiel has asked the DGFiP to begin informing affected users from Monday August 17.

He has also requested proposals on how security procedures could be strengthened and what lessons can be learned from what officials have described as an unprecedented attack on the tax administration.

DGFiP director-general Amélie Verdier apologised to taxpayers and urged those affected to be particularly cautious.

Potential for tax scams

The stolen information could allow criminals to make phishing emails, text messages or telephone calls appear more credible by referring to details such as a person’s tax situation.

The DGFiP has reminded taxpayers that its services never ask by email or telephone for bank details, personal information or identification data.

Genuine emails from the tax administration use addresses ending in @dgfip.finances.gouv.fr.

Taxpayers should also be wary of links taking them to websites that do not end in .gouv.fr.

Even if a telephone number appears genuine, taxpayers should not provide personal or banking information. Fraudsters can use so-called spoofing techniques to make calls appear to come from legitimate numbers.

The DGFiP has specifically warned about phishing attempts at a time when taxpayers may be expecting tax refunds or other communications from the administration.

Criminal investigation opened

The breach comes after several recent cyberattacks affecting French public institutions, including the Agence nationale des titres sécurisés (ANTS) and national statistics agency INSEE.

The Paris public prosecutor has opened an investigation into the attack.

Investigators will seek to establish how the attackers entered the tax administration’s systems, who was responsible and whether the stolen information has subsequently been used or shared.