France probes unprecedented cyberattack after tax data of 678,000 users stolen

The cybercrime unit of the Paris Public Prosecutor's Office is investigating the fraudulent extraction of data from a state-operated personal information system, following an attack described by tax officials as more sophisticated than previous incidents.

The investigation has been entrusted to France's Office for the Fight against Cybercrime, known as Ofac.

Prosecutors said the inquiry also covers suspected participation in a criminal conspiracy aimed at preparing an offence punishable by at least five years in prison.

The attack allowed hackers to extract data relating to 678,000 users of France's tax system, including both private individuals and companies.

Tax authorities said the incident was more complex than cyberattacks they had faced in the past, potentially renewing concerns over the security of government information systems following a series of recent breaches involving other public bodies.

Former French PM Attal files legal complaint over alleged Russian interference

Personal data exposed

For individual taxpayers, the information obtained included full names, family quotient details, reference taxable income and withholding tax rates, according to Amélie Verdier, Director-General of Public Finances.

However, the Directorate-General for Public Finances, or DGFiP, stressed that the stolen information does not provide access to taxpayers' secure accounts on the impots.gouv.fr website.

Officials said those affected would be contacted from early next week, with particular emphasis on alerting them to the potential risk of identity theft and fraudulent attempts to obtain further personal information.

For businesses, the information exposed was considered less sensitive, Verdier said.

It included details such as a company's SIREN registration number, its business address and the address of its authorised representative.

The incident comes after a number of cyberattacks involving French public institutions in recent weeks, including systems linked to the National Agency for Secure Documents, known as ANTS, and national statistics agency INSEE.

The latest breach is likely to add to scrutiny of the measures used to protect state-held data, particularly as cybercriminals increasingly target public administrations and databases containing large quantities of personal information.

Another cyber attack takes down France's online postal services

Government seeks lessons from attack

Public Accounts Minister David Amiel has asked the DGFiP to begin informing affected taxpayers as early as Monday, according to his office.

He has also requested proposals from the administration on how security procedures could be strengthened and what lessons should be drawn from what officials have described as an unprecedented attack on the tax authority.

The immediate priority is expected to be ensuring that those whose details were compromised are aware of the breach and remain vigilant against possible scams.

Although the stolen information cannot by itself be used to log into secure tax accounts, details such as income, tax rates and family circumstances could potentially be exploited to make fraudulent emails, messages or telephone calls appear more convincing.

Tax officials have therefore sought to reassure users about the integrity of the impots.gouv.fr platform while urging those contacted in connection with the breach to be particularly cautious about attempts to obtain passwords, banking information or other sensitive details.

The investigation will now seek to establish how the attackers gained access to the tax administration's systems, who was behind the operation and whether the stolen information has been shared or used elsewhere.

(with newswires)