French Tax Agency Breach Exposes Hundreds of Thousands of Records After Weeks of Undetected Access

French tax authorities confirmed that a cyber‑intruder exploited compromised staff passwords to harvest tax information on hundreds of thousands of individuals and businesses during June and July, a breach that remained hidden for roughly seven weeks.

According to the investigation, the attacker leveraged the stolen credentials to log into the tax administration's internal systems, where they were able to download extensive files containing personal and corporate tax data. The scope of the exfiltration, while not precisely quantified, is described as affecting a large portion of the tax base, underscoring the scale of the compromise.

The unauthorized activity was only detected after the tax administration and France's national cybersecurity agency, ANSSI, conducted a joint review of system logs and network traffic. Both agencies reported that none of the existing monitoring tools flagged the data leaving the network, suggesting that the attacker used legitimate access pathways that blended with normal operations.

In response, the tax administration has launched a full forensic investigation and is working with ANSSI to assess the full extent of the breach. Affected taxpayers and businesses are being notified, and the agency has pledged to strengthen its authentication mechanisms, including the rollout of multi‑factor authentication for all staff accounts.

Cybersecurity experts note that the incident highlights persistent vulnerabilities in credential management across public institutions. Stolen passwords, especially when paired with privileged access, can bypass many perimeter defenses, making robust identity verification and continuous monitoring essential to detect subtle data‑exfiltration attempts.

French officials have indicated that legal proceedings may follow, and that the breach could prompt a review of existing data‑protection regulations. As the investigation continues, the incident serves as a cautionary tale for governments worldwide about the risks of credential theft and the need for resilient, layered security architectures.