France’s Directorate General of Public Finances confirmed in late August 2026 that data on approximately 678,000 individuals and professionals had been consulted and extracted from its systems during June and July. The route was not an exploit: compromised credentials belonging to a DGFiP employee and to an authorised third party were used to query systems those accounts were entitled to reach. Exposed fields include reference tax income, family quotient and withholding rates; for businesses, names and SIREN numbers; and cadastral data covering addresses and property sizes.
Disclosure followed the market. An actor using the handle ZeroBytes claimed access on 12 and 13 August and listed a database for sale on a criminal forum; the ministry’s confirmation and the ANSSI investigation came after. Online tax accounts, usernames and passwords were not compromised, per the authority.
Two Accounts Doing What They Were Allowed To Do
Both credentials were legitimate, and one belonged to an outside party authorised to query the register — the arrangement every large administration runs, and the pattern filed at 25-0421b as the dominant intrusion mode of this period. Authentication succeeded every time. The control that failed sits a layer up: nothing asked why two accounts were consulting records at a scale no ordinary workload produces, the bulk-retrieval blindness recorded at 25-0612 when 300,000 crash reports left Texas the same way.
A Register Nobody Can Leave
A taxpayer cannot close their account with the tax authority, choose a competitor or decline to file. Reference income and family quotient are precisely the fields a convincing tax-refund scam quotes to prove it is genuine, and 678,000 people now face that exposure through a relationship they were never free to refuse.
The Seller Announced It Before The State Did
The sequence — forum listing on 12 August, official confirmation later in the month — repeats the ordering this database keeps recording: the attacker publishes first, on their own timeline, with their own figures. Here the official count of 678,000 arrived with an investigation behind it, and the forum claim of 600,000 undershot it. Claims can run low as well as high; what they cannot do is substitute for a count someone verified.
Compiled from the ministry’s statements as reported and contemporaneous coverage, listed below. The 678,000 figure and the credential route are the authority’s findings; the forum claim is carried as a claim. The seller’s handle is reported, not verified as an identity. Graded high. Corrections: corrections@forensicpost.com.