Warnings sent to French taxpayers after hackers allegedly sell stolen data

The Directorate-General for Public Finance (DGFiP) began sending individual warning emails on Monday evening, following an emergency interministerial meeting called by Prime Minister Sébastien Lecornu. The messages will be sent throughout the week.

The DGFiP confirmed last week that hackers had gained access to its systems during two intrusions, one in late June and another in late July.

Data from at least 678,000 individuals and businesses was stolen, along with information linked to around 200,000 accounts in the office's land registry databases.

France probes unprecedented cyberattack after tax data of 678,000 users stolen

The stolen information may include names, tax identification numbers, contact details, tax circumstances and reference tax incomes, among other data. In fewer than 250 cases, hackers may also have accessed messages exchanged between taxpayers and the tax administration.

The DGFiP said passwords, tax returns and tax notices were not compromised. It also said the stolen information cannot be used to access or operate taxpayers' online accounts.

However, the amount of detail in the stolen files has raised concerns about targeted scams.

The warning letters being sent to affected taxpayers urges them to be particularly cautious about anyone claiming familiarity based on data from the breach. Taxpayers are being encouraged to ignore requests for information made via email or telephone, and to regularly monitor their bank accounts.

“The DGFiP will never ask you to provide information outside your secure online account,” the office said in a social media post.

Another cyber attack takes down France's online postal services

'Easy to hack'

The government said access points used by the hackers were closed after the incidents, and that the security of tax accounts has been strengthened.

Lecornu ordered the National Agency for Information Systems Security to conduct an “in-depth audit to establish the exact circumstances and causes” of the attacks. In addition, the Paris prosecutor's office has opened an investigation into “fraudulent extraction of data” and “criminal conspiracy”.

Lecornu also called for faster implementation of a wider plan to strengthen the security of government computer systems, many of which have been the target of cyber attacks and hacks in recent months.

As Africa rapidly goes digital, it becomes a prime target for hackers

The cybercriminal group ZeroBytes, which claims to be made up of two French hackers, said it had sold the stolen data.

Speaking to French news agency AFP via the Telegram messaging service, the group alleged that two people bought the information for “thousands of euros” and that the data remains for sale.

Before targeting the tax office, ZeroBytes claimed on dark web forums to have hacked the Intermarché supermarket chain and the French Handball Federation.

The group also claimed to have stolen data over the summer from a major French telecommunications operator and a hotel group – neither company has confirmed an attack. 

ZeroBytes says French organisations are frequent targets because they are “easy to hack”.

(with AFP)