Hack of French tax data base possible because of weak systems, finds report

When France moved towards having a mainly internet-based tax system, the government made much of the fact that the cybersecurity surrounding the Direction générale des finances publiques (French tax authorities, DGFiP) was among the tightest in the world.

This did not stop highly embarrassing hacks this summer, where personal details of some 678,000 individuals and businesses were downloaded and then reportedly offered for sale on the internet. 

At the time the government promised to inform all people and businesses whose data was stolen in the leak.

Ultimately, three data breaches were recorded by tax authorities this summer. 

Hacking ‘not sophisticated’

A report published by the government body set up in 2009 to protect national cyber security, Agence nationale de la sécurité des systèmes d’information (Anssi) said after a six-week enquiry, that the first and largest hack “was not sophisticated”.

Instead, it exploited basic weaknesses built into the DGFiP computer system, which could be entered by anyone in the interministerial computer network.

The report details two hacks, one that targeted personal information of taxpayers, and another that downloaded information from the cadastrales property register held by the tax authorities.

Bank details were not included in the hacks, but other information available on a tax declaration, including name, addresses, telephone numbers, family situation, and declared taxes was.

The first breach was possible because the hackers were able to enter the system by using the email address of a fonctionnaire (civil servant).

The data stolen from the cadastrales register came after hackers gained entry to the database through the computer of a contractor at a private company, which had access to the system.

However, the Anssi report highlights that several civil servants were targeted, mostly using their own and not an official DGFiP computer.

Another issue was that there was no system of double identification on the database for the civil servants.

Double identification involves a password followed by an authentication on a second device, usually a mobile phone. This can include a biometric (face or fingerprint scan), or entering a code sent through text or email.

However, this system is used for the cadastales database, but was bypassed by hackers.

The prime minister’s office, which is handling enquiries about the hack did not respond when asked by The Connexion what exactly had happened.

Multiple faults discovered

A second fault in the basic design of the system was identified by Anssi.

Confidential information was not fenced off and protected, and could be accessed – for work purposes – by anyone having access to the government’s ministerial internal computer system.

The final serious fault was the lack of alarms which should have gone off when large quantities of data were exported from the DGFiP computer system.

Such alarms were in place elsewhere in the system, but they were not for the data compromised.

As a first measure, Anssi recommended that access to the DGFiP computers from personal computers be ended.

It also recommended that work to fence off the system is undertaken so that the number of people who could access it is restricted.

Authorities arrested two males, aged 18 and 16, who are suspected of being behind the hack.

The former has been in custody since the end of August, both have been put under mis en examen status by an investigating judge while enquiries continue.

No date has been set for a court appearance.

Concerns over digitisation of services

Meanwhile, it has become evident that the hack of the tax system has shaken the confidence of the public in the digitisation of government services.

An example is in an open letter from a shopkeepers’ association in Essonne department, complaining about the cost of the new electronic billing system, and also mentions fears about the safety of data systems in the light of the hack.

“The DGFiP says we have to have confidence in the system, but they themselves have been hacked,” the association said.

Anssi received reports of 99 hacks of government computers in August and September.

Many were attributed to services not having double authentication methods, and civil servants’ email addresses being used, with either weak passwords, or with passwords that were stolen.

Work details of potentially as many as 4,350,000 teachers were accessed from Education Nationale computers, and 300,000 teacher and student details were hacked from the foreign ministry computers recording French teaching abroad.

A subcontractor of another part of the finance ministry, Tracfin, that fights money laundering, was hacked temporarily. Personal details of workers, and details of complaints made to Tracfin, were exposed.

Other ministries affected include:

• The environment ministry where files on properties and electric vehicles were hacked

• The labour ministry, where a platform enabling people to get degree equivalents from experience at work was accessed  

• The ministry of agriculture, where a professional training site was hacked

• The prime minister's office, where it was found that old accounts which should have been shut down, were being used by unknown people to access administrative details.