--- title: "French tax authority breach exposes 678,000 tax… | Firevault" description: "France's Directorate General of Public Finances has confirmed that attackers used compromised access points to extract tax and cadastral data on 678,000…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/french-tax-authority-dgfip-data-breach-678000-2026#webpage", "url": "https://fire-vault.com/news/french-tax-authority-dgfip-data-breach-678000-2026", "name": "French tax authority breach exposes 678,000 tax…", "description": "France's Directorate General of Public Finances has confirmed that attackers used compromised access points to extract tax and cadastral data on 678,000…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/french-tax-authority-dgfip-data-breach-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/french-tax-authority-dgfip-data-breach-678000-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/french-tax-authority-dgfip-data-breach-678000-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "French tax authority breach exposes 678,000 taxpayers and the land registry behind them", "item": "https://fire-vault.com/news/french-tax-authority-dgfip-data-breach-678000-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "French tax authority breach exposes 678,000 taxpayers and the land registry behind them", "description": "France's Directorate General of Public Finances has confirmed that attackers used compromised access points to extract tax and cadastral data on 678,000 individuals and businesses. The same seller claims to have held a live session on the central land registry platform covering roughly 20 million people.", "url": "https://fire-vault.com/news/french-tax-authority-dgfip-data-breach-678000-2026", "image": [ { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/french-tax-authority-dgfip-data-breach-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/french-tax-authority-dgfip-data-breach-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/french-tax-authority-dgfip-data-breach-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/french-tax-authority-dgfip-data-breach-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Director & Co-Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-08-17T20:17:03.632714+00:00", "dateModified": "2026-08-28T08:03:22.256672+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/french-tax-authority-dgfip-data-breach-678000-2026" }, "inLanguage": "en-GB", "articleSection": "Insight", "wordCount": 591, "keywords": "French, Insight, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "The French Ministry of the Economy and Finance has confirmed a data breach at the Directorate General of Public Finances (DGFiP) after an attacker used compromised access points to consult and extract data on 678,000 individuals and professionals. The incident surfaced publicly on 12 August 2026, when a threat actor operating under the handle ZeroBytes listed a stolen database for sale on a crimin", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview What was takenThe land registry is the real prizeA pattern across the French publ…Why tax and property data does n…The Firevault viewMore Resources [Knowledge Vault](/learn/knowledge)/ [News](/learn/knowledge?filter=news) News · Insight · 17 August 2026 # French tax authority breach exposes 678,000 taxpayers and the land registry behind them France's Directorate General of Public Finances has confirmed that attackers used compromised access points to extract tax and cadastral data on 678,000 individuals and businesses. The same seller claims to have held a live session on the central land registry platform covering roughly 20 million people. ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) Mark Fermor Director & Co-Founder, Firevault 3 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffrench-tax-authority-dgfip-data-breach-678000-2026)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffrench-tax-authority-dgfip-data-breach-678000-2026&text=French%20tax%20authority%20breach%20exposes%20678%2C000%20taxpayers%20and%20the%20land%20registry%20behind%20them%0A%0AFrance's%20Directorate%20General%20of%20Public%20Finances%20has%20confirmed%20that%20attackers%20used%20compromised%20access%20points%20to%20extract%20tax%20and%20cadastral%20data%20on%20678%2C000%20individuals%20and%20businesses.%20The%20same%20seller%20claims%20to%20have%20held%20a%20live%20session%20on%20the%20central%20land%20registry%20platform%20covering%20roughly%2020%20million%20people.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffrench-tax-authority-dgfip-data-breach-678000-2026)[](mailto:?subject=French%20tax%20authority%20breach%20exposes%20678%2C000%20taxpayers%20and%20the%20land%20registry%20behind%20them&body=France's%20Directorate%20General%20of%20Public%20Finances%20has%20confirmed%20that%20attackers%20used%20compromised%20access%20points%20to%20extract%20tax%20and%20cadastral%20data%20on%20678%2C000%20individuals%20and%20businesses.%20The%20same%20seller%20claims%20to%20have%20held%20a%20live%20session%20on%20the%20central%20land%20registry%20platform%20covering%20roughly%2020%20million%20people.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Ffrench-tax-authority-dgfip-data-breach-678000-2026) ![French government finance ministry building at blue hour with a single lit window, representing the DGFiP tax data breach](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/french-tax-authority-dgfip-data-breach-2026.jpg) French government finance ministry building at blue hour with a single lit window, representing the DGFiP tax data breach Why it matters ## What this means for organisations holding critical data France's Directorate General of Public Finances has confirmed that attackers used compromised access points to extract tax and cadastral data on 678,000 individuals and businesses. The same seller claims to have held a live session on the central land registry platform covering roughly 20 million people. In this analysis 1. 01 [What was taken](#section-0) 2. 02 [The land registry is the real prize](#section-1) 3. 03 [A pattern across the French publ…](#section-2) 4. 04 [Why tax and property data does n…](#section-3) **On this page**[What was taken](#section-0)[The land registry is the real prize](#section-1)[A pattern across the French publ…](#section-2)[Why tax and property data does n…](#section-3) The French Ministry of the Economy and Finance has confirmed a [data breach](/learn/breaches) at the Directorate General of Public Finances (DGFiP) after an attacker used compromised access points to consult and extract data on 678,000 individuals and professionals. The incident surfaced publicly on 12 August 2026, when a threat actor operating under the handle ZeroBytes listed a stolen database for sale on a criminal forum. ## What was taken According to the ministry, the extracted material includes tax data such as reference tax income, family quotient and withholding tax rate. For businesses it includes company names and SIREN numbers. Cadastral data covering addresses and property sizes was also accessed. The ministry states that user accounts were not compromised and that identifiers and passwords were not exposed. Affected individuals and professionals are being contacted directly by email or letter. ## The land registry is the real prize The seller also claims access to the Serveur Professionnel de Donnees Cadastrales, the professional platform that fronts the French central land registry. That portal is said to expose records relating to roughly 20 million citizens. By the attacker's own account the extraction was abandoned because the volume was impractical to scrape, with around 252,149 records taken covering data on more than 2 million people, and the session left open for a buyer to continue. That detail matters more than the headline figure. The limit on this breach was not a security control. It was the attacker's patience. ## A pattern across the French public sector This is not an isolated failure. France Travail lost the personal information of 43 million people and was fined 5 million euros by the data protection authority in January. The Ministry of Finance disclosed a separate breach affecting more than 1.2 million accounts tied to the national bank account registry. France Titres disclosed a breach after a seller advertised 19 million records attributed to the national secure documents agency. Each case follows the same shape: a legitimate access path into a large retained dataset, used by someone who should not have had it. ## Why tax and property data does not age out Credentials can be rotated. Income bands, household composition, withholding rates, property addresses and plot sizes cannot. This is durable identity and wealth data, useful for fraud, coercion and targeted social engineering for years after the incident. A citizen has no ability to change it and no route to withdraw it. ## The Firevault view Every element of this breach depended on one precondition: the retained records were reachable from a network by whoever held a valid access point. No platform vulnerability was needed, and none was reported. The access was legitimate in form and hostile in use. [Offline Secure Storage](/offline-secure-storage)® (#OSS) removes that precondition. A Firevault Vault holds retained records on [physically disconnected storage](/storage) inside a secure bunker, so there is no path to enumerate, no panel to stay logged into and no dataset to scrape. Access is opened deliberately by a named person, used, then removed again. Firevault Control governs the route into live systems so a compromised credential does not inherit standing reach. Mark Fermor, co-founder of Firevault, said: "A public authority holding tax and land registry data on 20 million people should not be relying on the attacker running out of patience. The archive that carries the longest liability is the archive that has the least reason to be online." The question for any organisation holding long-lived citizen or customer records is not whether the perimeter held. It is how much of that archive was reachable at all. **Source:** [BleepingComputer, French tax authority data breach affects 678,000 individuals](https://www.bleepingcomputer.com/news/security/french-tax-authority-data-breach-affects-678-000-individuals/). About the author ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## Controls an auditor can physically verify Firevault gives you physical separation, named custody and evidenced access, so compliance claims about isolation and control are things you can show, not just assert. [Get started](/get-started)[Talk to the team](/demo) **Custody**Named, access-controlled hardware in a Firevault Bunker **Evidence**Access windows and retrieval events are recorded **Separation**Physical isolation that satisfies offline copy requirements **Jurisdiction**Stored where your regulatory position requires Related Reading ## You may also find these useful [ ![Airport WiFi sign-ups turn into a national data problem as 8.7 million customer records are accessed](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/manchester-airports-group-data-breach-2026.jpg) Insight ### Airport WiFi sign-ups turn into a national data problem as 8.7 million customer records are accessed Manchester Airports Group has confirmed that criminal hackers accessed the data of about 8.7 million customers across Manchester, East Midlands and London Stansted. Most of it came from free terminal WiFi sign-ups and from car parking, lounge and fast-track bookings. 27 Aug 2026 5 min ](/news/manchester-airports-group-data-breach-87-million-customers-2026)[ ![T-Mobile pulled the plug on Salt Typhoon. It took a car journey to get there.](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/tmobile-power-pull-salt-typhoon-2026.jpg) Insight ### T-Mobile pulled the plug on Salt Typhoon. It took a car journey to get there. T-Mobile's security chief ended months of failed software remediation by driving to the data centre, clearing ID, finding the cabinet and physically pulling the power supply from the compromised hardware. Disconnection was the right control. Firevault Control is designed to take the same action in under six milliseconds. 27 Aug 2026 7 min ](/news/tmobile-severs-network-cable-salt-typhoon-hackers-2026)[ ![Beacon breach: 1,500 charities exposed and an HIV charity's health data stolen](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/george-house-trust-beacon-charity-data-breach-2026.jpg) Insight ### Beacon breach: 1,500 charities exposed and an HIV charity's health data stolen People supported by a Manchester HIV charity have been told sensitive health information may have been stolen after a breach at Beacon, the shared database platform used by more than a thousand UK charities. One supplier, one connected database, national exposure. 26 Aug 2026 3 min ](/news/beacon-charity-database-breach-hiv-charity-health-data-2026)[ ![Iran-linked hackers shut down a UK power plant for four days](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/iran-uk-power-plant-cyber-attack-2026.jpg) Insight ### Iran-linked hackers shut down a UK power plant for four days A small British generator was taken offline for four days after an Iran-linked cyber attack, reported as the first successful intrusion of its kind against UK power generation. The grid held. The control layer did not. 23 Aug 2026 4 min ](/news/iran-linked-hackers-uk-power-plant-shutdown-2026)[ ![GTA 6 leaks: a nightmare or a blip for the biggest video game of the year?](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/gta6-leaks-rockstar-2026.jpg) Insight ### GTA 6 leaks: a nightmare or a blip for the biggest video game of the year? Unreleased Grand Theft Auto 6 footage has appeared online ahead of Rockstar's official preview, and Take-Two is now in court seeking the identities behind the accounts sharing it. The game will still sell. The material that leaked can never be unseen. 22 Aug 2026 3 min ](/news/gta-6-leaks-rockstar-development-footage-2026)[ ![Nine PBS: 50 Terabytes of History Trapped by a Cloud Vendor That Closed](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/nine-pbs-archives-cloud-vendor-shutdown-2026.jpg) Insight ### Nine PBS: 50 Terabytes of History Trapped by a Cloud Vendor That Closed A public broadcaster lost access to fifty terabytes of archival footage, spanning seventy years of regional history, when its cloud storage supplier suddenly went out of business. The files are still trapped in a Denver data centre. 18 Aug 2026 4 min ](/news/nine-pbs-archives-cloud-vendor-shutdown-2026) ## Suggested Reading - [What is Offline Secure Storage The foundation of physical disconnection ](/how-it-works/offline-secure-storage) - [Why Offline Secure Storage The case for physical control ](/why-oss) - [Ransomware Defence Hold gold copies offline ](/oss-for-ransomware-recovery) - [Control Physical path control for IT and OT ](/solutions/control) - [Knowledge Vault All articles, guides and whitepapers ](/learn/knowledge) - [Book a Demo See Firevault in action ](/demo) [Back to Knowledge Vault](/learn/knowledge)