DGFiP Breach via Stolen Credentials Enabled VPN and Internal Search Tool Access in Late June

The French Economy Ministry confirmed unauthorized access to Directorate General of Public Finances systems occurred in late June through credential compromise. The intruder viewed and extracted personal data on individuals and businesses, including names, tax IDs, emails, family details, and tax status. Access ended after detection, but the ministry has not yet specified exact records taken or victim count. DGFiP plans individual notifications and a criminal complaint.

FrenchBreaches tracked the claim by alias ZeroBytes of over 600,000 records obtained before eviction. The hacker described pivoting from internal servers to the agency VPN and using a native search function for targeted queries. No independent verification of the dataset or access method exists. Official statements emphasize containment while avoiding any technical attribution or confirmation of the volume asserted.

This incident fits a documented 2024 pattern of French government breaches involving credential reuse or theft, including ANTS passport systems, Education Ministry student accounts, and the National Bank Accounts File exposing 1.2 million entries. Each case showed delayed public disclosure and reliance on identity-based initial access rather than zero-days. The absence of CVE-linked technical indicators leaves open whether this was opportunistic or part of broader reconnaissance.

Next steps include CNIL notification and possible expansion of multi-factor controls on internal tools. Victim contact will test whether DGFiP maintains accurate logging of queries performed during the window.