Overview
- The DGFiP said two intrusions, occurring at the end of June and the end of July, allowed attackers to consult and extract fiscal and personal data for about 678,000 individuals and companies.
- Stolen fields include names, contact details, revenue fiscal reference, quotient familial, and withholding rates while the administration says account passwords and direct access to impots.gouv.fr were not compromised.
- The Parquet de Paris has opened a cyber investigation and assigned the Office anticybercriminalité (OFAC) to pursue charges such as fraudulent data extraction and association of wrongdoers.
- A group calling itself ZeroBytes has claimed responsibility and says some files were sold on dark‑web forums, a claim that authorities and journalists say remains unverified.
- The government has begun notifying victims by email and letter, warned about phishing and identity‑fraud risks, ordered an ANSSI audit, and faces renewed calls in parliament to probe state IT vulnerabilities.