ANSSI Says Basic Security Failures Caused DGFiP Hack as Metabase Leak Exposes ANSSI and Dinum Accounts

Overview

• ANSSI published a 29 September 2026 incident report that concluded the DGFiP compromise was not a sophisticated attack but the result of three basic failures: credential protection, system architecture, and attack detection.
• Attackers exfiltrated data from two DGFiP perimeters — the impots.gouv.fr platform and cadastral systems — an episode ANSSI said affected roughly 700,000 users.
• ANSSI found intruders used DGFiP agents’ credentials that had been reused on personal devices and on portals lacking multi‑factor authentication, leaving logins exposed.
• Lateral movement was possible because sensitive applications were reachable from the Réseau interministériel de l’État without sufficient segmentation, and exfiltration in July–August went undetected by DGFiP and ANSSI monitoring.
• A separate Metabase compromise on 6 August leaked about 120 accounts, including roughly 30 external users and some ANSSI and Dinum accounts, and agencies say they have patched instances, reset passwords and removed stale accounts while questions about governance and trust remain.