French tax authority hack: what the ANSSI report reveals and what taxpayers can do

Staff credentials stolen from personal computers, portals without strong authentication, fourteen gigabytes of tax data extracted without a single alert being raised: the report published by the ANSSI on 29 September 2026 describes a compromise that the agency itself calls unsophisticated. For taxpayers whose data was exposed, it also sheds light on the risks ahead and on the remedies available to them, against the bank as before the courts.

Key points

• The report of the French National Cybersecurity Agency (ANSSI), published on 29 September 2026, concludes that the hack of the French tax authority (DGFiP) was not the result of a sophisticated attack, but of weaknesses in identity management, architecture and detection.
• The attacker used staff credentials, probably stolen from computers not managed by the DGFiP, on portals without strong authentication. Around 14 GB of data were extracted without any alert being raised.
• The exposed data are identity, contact and tax status data. They make fake bank adviser scams more credible.
• In the event of fraud, the burden of proving the customer’s gross negligence lies with the bank, but gross negligence is assessed in concreto, in the light of the circumstances of each case.

What happened at the DGFiP?

On 12 August 2026, an actor calling itself Zerobytes claimed on a forum to have stolen data from the impots.gouv.fr platform. The investigation established that the exfiltration had taken place seven weeks earlier¹. The ANSSI report, requested by the Prime Minister, was submitted on 24 September and published on 29 September 2026².

The report identifies no brute-force attack: the attacker already held the passwords. Over three months, it gathered several dozen credentials belonging to DGFiP staff, probably stolen by infostealer malware installed on computers not managed by the DGFiP, including personal devices. It used them to reach, through the French government’s inter-ministerial network and from compromised infrastructure of the Ministry of National Education, the E-Contact application, which handles exchanges with taxpayers. A second strand, concerning land registry data, began with the compromised computer of a chartered surveyor¹.

The investigation opened by the Paris public prosecutor was entrusted to the Anti-Cybercrime Office. An 18-year-old suspect was placed under formal investigation and remanded in custody, as the prosecutor announced on 4 September 2026⁴. A second suspect, aged 16, was placed under formal investigation and under judicial supervision, as the prosecutor confirmed on 29 October 2026⁵.

Timeline of the French tax authority hack

What the report establishes, and what is only claimed

The dates, the accounts used, the volumes and the absence of detection result from the investigations of the DGFiP and the ANSSI. The victim figures call for more caution: Zerobytes announced 678,437 records, whereas the summary of the report states that the published data concern nearly 353,000 individuals and 252,000 professionals. For the land registry, the figure of 2 million people is the attacker’s, which the report mentions without endorsing it. Finally, the origin of the credential theft is only “probable”¹.

According to the Ministry of the Economy, the data that may have been accessed are the tax identification number, civil status, postal, telephone and email contact details, tax status (family situation, dependants, number of tax shares, reference taxable income, withholding tax rate) and the list of messages exchanged with the DGFiP. Users’ online tax accounts were not compromised³.

The failings identified by the ANSSI

Two portals, one of which gave access to sensitive resources, had no multi-factor authentication, so that a stolen password was enough. On the portal reserved for partners, the second factor was a code sent by email, which the compromise of the chartered surveyor’s computer made it possible to bypass. Sensitive applications were also reachable from the inter-ministerial network without segmentation¹.

Detection failed. The portal used for the exfiltration was not monitored by the DGFiP’s security operations centre, and no mechanism correlated the night-time logins, the abnormal volumes and the malicious IP addresses. On 24 June, resetting the password of the account used ended neither the session nor the exfiltration, which continued until 2:31 the next morning. The ANSSI acknowledges that its own systems detected nothing¹.

The report recommends, among other things, prohibiting the use of personal devices to access professional resources, generalising multi-factor authentication with a second factor that resists the compromise of the first, and revoking active sessions whenever a password is reset¹.

Your data has leaked: what to expect

According to the Ministry, the consequences of the leak mainly concern phishing attempts or fraudulent calls, in particular fake bank adviser scams, made more credible by the mention of the victim’s personal data. They may also be used in identity theft attempts, which nevertheless require the fraudsters to obtain a copy of the victim’s identity documents³; the remedies in that case are set out in our analysis of online identity theft. The fraudster poses as an agent of the bank’s anti-fraud department, sometimes spoofing its number, and asks, in order to block supposedly suspicious transactions, for codes or confirmations in the banking app, which in fact serve to validate fraudulent transactions⁶.

The tax authority never asks for confidential information by email, text message or telephone³. No bank adviser asks a customer to take action in the app to stop an alleged fraud, and customers are advised never to validate a transaction they did not initiate, even on the pretext of cancelling it⁶. Where an email or social media account has been taken over by a third party, the steps to take are set out in our analysis of hacked accounts.

Fraud after the leak: must the bank refund?

In the event of an unauthorised payment transaction, the bank must refund immediately, and at the latest by the end of the next business day after notification, unless it suspects fraud by the customer and communicates its reasons in writing to the Banque de France (Article L. 133-18 of the Monetary and Financial Code). The customer bears all the losses only in the event of fraud or gross negligence on their part (Article L. 133-19, IV).

The burden of proving such gross negligence lies with the bank (Article L. 133-23) and it cannot be inferred from the mere fact that the customer’s security credentials were used^{7 8}. Gross negligence is, however, found where the customer discloses their credentials in response to a message containing clues that would lead a normally attentive user to doubt its origin⁷.

In fake adviser calls, the assessment is concrete. The Cour de cassation upheld the exclusion of gross negligence where the bank’s number was displayed and the customer believed they were validating a secure transaction⁹, or where the fraudster, calling from a spoofed number, knew the day’s transactions¹⁰. Conversely, it quashed a court of appeal judgment that had excluded gross negligence as a matter of principle, on the ground that the fraudster knew the victim’s address and card number, without examining the voluntary disclosure of their credentials¹¹. The fraudster’s knowledge of accurate personal data is therefore a factor in the assessment, not an automatic exemption. The file benefits from documenting precisely how the call unfolded.

The transaction must be reported without delay, and at the latest within thirteen months of the debit date (Article L. 133-24). Where the victim personally ordered the transfer, the debate first concerns whether the transaction was authorised (Article L. 133-6).

Filing a complaint: against whom, and for what?

Hacking into a personal data processing system operated by the State is punishable by seven years’ imprisonment (Articles 323-1 and 323-3 of the Criminal Code), and by ten years when committed by an organised gang (Article 323-4-1).

A victim of a fake bank adviser or a fake tax official is the victim of fraud (Article 313-1 of the Criminal Code). The Ministry invites victims to report the facts on cybermalveillance.gouv.fr and then to file a complaint, online where available³. Victims are advised to keep the number displayed, the messages, the transfer orders and the statements⁶. Joining the proceedings as a civil party requires having personally suffered damage directly caused by the offence (Article 2 of the Code of Criminal Procedure).

The State as data controller

The State is exempt from fines imposed by the French data protection authority, the CNIL (Article 20, IV, 7° of the Law of 6 January 1978), and from the criminal liability of legal persons (Article 121-2 of the Criminal Code), as explained in our article on the criminal liability of company directors after a cyberattack.

It nevertheless remains liable to compensate damage caused by an infringement of the GDPR (Article 82). In a case concerning the hacking of the Bulgarian revenue agency, the Court of Justice of the European Union held that the controller bears the burden of proving that its security measures were appropriate, that it cannot be exempted from liability merely because the damage was caused by third parties, and that fear of possible misuse of personal data is capable, in itself, of constituting non-material damage¹². Such an action falls in principle within the jurisdiction of the administrative courts¹³, before which the findings of the ANSSI report would be evidence of the first order.

How the firm can help

The firm practises cybercrime and digital criminal law. For victims of fraud following the leak, it challenges the transactions and the refusal to refund, files criminal complaints for fraud and conducts claims for reimbursement or compensation. For professionals whose computers or accounts have been compromised, it acts from the first hours, for the complaint as for the notifications.

Frequently asked questions

How do I know whether my data is part of the leak?

Since 17 August 2026, the DGFiP has been notifying the persons concerned individually, by email or, failing that, by post. Its emails always come from an address ending in “@dgfip.finances.gouv.fr” or “@authentification.impots.gouv.fr”.

Were my bank details or password stolen?

The list published by the Ministry of the Economy mentions neither bank details nor passwords, and states that users’ online tax accounts were not compromised.

My bank refuses to refund me, citing gross negligence. What can I do?

The burden of proving gross negligence lies with the bank and cannot be inferred from the mere use of the security credentials. It is assessed in concreto: the case law has excluded it in several fake adviser cases, without excluding it as a matter of principle. The refusal can be challenged.

How long do I have to challenge a fraudulent transaction?

Without delay, and at the latest within thirteen months of the debit date. The bank must in principle refund by the end of the next business day after notification.

Can I obtain compensation from the State?

The State is exempt from CNIL fines, but remains liable to compensate damage caused by an infringement of the GDPR. According to the Court of Justice of the European Union, fear of possible misuse of personal data may in itself constitute non-material damage.