Direction générale des finances publiques (DGFiP)
ModerateConfirmedPublic sector
Unauthorized access to the information system of the French tax administration (DGFiP) occurred in June and July 2026, obtained using stolen credentials belonging to an agency staff member and an authorized third party. This access allowed the consultation and extraction of data concerning about 678,000 individuals and businesses: civil status, addresses, tax identifiers, reference fiscal income, family quotient, withholding tax rate, as well as company names and SIREN numbers for businesses, and land registry information on real estate. The DGFiP states that taxpayers' personal online accounts were not compromised and that passwords were not stolen.
This precise, verified tax data could be used to commit fiscal identity fraud or to craft credible, targeted phishing attempts.
- Disclosed on
- August 14, 2026
- Accounts affected
- 678,000
- Sector
- Public sector
- Country
- France
- Cause
- Credential stuffing
Exposed data
- Full name
- Postal address
- Customer ID
- Employment data
- Other personal data
You are only affected if you had an account or an order with this organisation.
What you can do
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
- La CNIL va contrôler le fisc après la cyberattaque de la DGFiPCyberattaque.org
- Accès illégitimes au système d'information de la Direction générale des Finances publiques : consulter la FAQeconomie.gouv.fr
- Cyberattaque contre la DGFiP : 678.000 usagers potentiellement concernésLégiFiscal
- Fuite de données à la DGFiP : ce que doivent faire les entreprises concernéesComptaverse
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact