Hooded hacker typing on a laptop with a skull, flanked by blue government-style buildings and data folders, a glowing red lock below.

French State Data Breaches Keep Piling Up: DGFiP, Cadastre, and Education Ministry Hit

2026-08-19 Florian Burnel 0 Comments

Three separate incidents at the DGFiP in one week, 678,000 users affected, 1.8 million cadastral accounts, and a claim involving 346 million lines at the Education Ministry. In the middle of summer, two French government departments had their data siphoned off. The situation is serious, and, above all, the story keeps repeating month after month. Here is what we know, and, more importantly, what still needs to be confirmed.

DGFiP: three incidents, three different causes

Let's start with the tax authority cyberattack, which is actually tied to three different incidents.

First incident

On August 12, 2026, a hacker using the alias ZeroBytes claimed access to the information system of the Direction générale des Finances publiques. Bercy confirmed it two days later through an official press release. Even though this case was disclosed in mid-August, the intrusions date back to June and July, and rely on "identity spoofing of a DGFiP agent and an authorized third party." One credential theft, and as you will see, there were more.

The accounts, and therefore access, were cut off as soon as the intrusion was detected. "However, the access controls carried out on that occasion did not detect that these intrusions had led to data theft, due to the sophistication of the attack.", Bercy explains. So the door is closed without asking what the attacker may have walked away with...

Now we know. The total: 678,000 individuals and businesses, with a fairly precise breakdown. Just over 350,000 individuals and 250,000 businesses. Here is what the hacker ZeroBytes may have viewed or extracted:

Tax ID, civil status, postal, phone, and email contact details.
Tax profile: family situation, dependents, number of parts, reference tax income, and withholding tax rate.
List of messages exchanged with DGFiP, and for fewer than 250 taxpayers, their content.
For companies, business name and SIREN.

Personal and sensitive data are therefore in the hands of the attacker. The good news is that the Finances publiques accounts were not compromised and passwords are not among the stolen data. That does not prevent some families and businesses from being particularly exposed by this incident.

Second incident

On August 13, ZeroBytes claimed access to the professional cadastral data server (SPDC), used by authorized agents, notaries, and surveyors. He says he was able to exfiltrate 252,149 lines of data, or 2,041,778 holders according to his own count. DGFiP first put the figure at 200,000 accounts... before revising it upward to a much larger number: 1.8 million. That brings the official estimate much closer to the attacker’s count. Here again, the access came from a compromised account.

Third incident

Now let's talk about the public portal for vacant estates, which was also targeted by the hacker. This time, there was no identity spoofing. According to FrenchBreaches, a vulnerability spotted by the hacker group LunarisSec may have allowed access to logs containing personal data, without authentication: identities, addresses, dates and places of death, marital status, and asset-related details. The flaw has reportedly since been fixed.

Amélie Verdier, Director General of Public Finances, clarified: "We are talking about a portal that is a tool accessible to everyone, and not authenticated. And in a way, the attacker gained access to a request log." - Here, this is not about tax data, but rather sensitive personal data, some of which is absent from the other leaks.

Education Ministry: 346 million lines, how many victims?

On July 31, the Ministry of National Education acknowledged an intrusion. Here again, the breach dates back to late July, more precisely to the night of July 25, 2026. The method is the same: a compromised professional account provided access to the system used for staff training. The result, once again, was the leakage of personal data: identity, job title, contact details, and for some staff, social security numbers.

This intrusion did not attract much attention until August 17, when ZeroBytes decided to talk about it. Yes, him again. He claims to hold 43 GB of data across 2,500 files, or 346,178,591 raw lines. The data set is broken down into three blocks:

About 24 GB and 1,581 files, mainly linked to the Créteil school district.
About 17.8 GB and 1,048 I-Prof exports, covering all 33 French school districts.
About 1.6 GB of Créteil and Versailles LDAP directories, representing more than 600,000 account entries, including password hashes.

Several systems are explicitly named: BE1D for primary education, SCONET for secondary education, and SCHAAF for the federated academic directory.

But be careful with the figures: 346 million lines does not mean 346 million victims. Multiple lines can correspond to the same person. For example, a teacher who changed assignments five times appears five times. The same goes for a student tracked over the years and throughout their school career.

In fact, ZeroBytes himself speaks instead of about 4.35 million staff identifiers and 1.22 million unique students. However, at this stage, the real number of people affected remains unknown. Beyond the number of people potentially impacted by this incident, what is troubling is the time span covered by the leak.

Indeed, some files date back to 2005 while others are recent and up to date as of July 2026, which represents more than 20 years of school and professional history. In other words, a former student who left the system in 2010 and is now an adult may appear in these files.

ZeroBytes also took the opportunity to point out weaknesses in the Education Ministry's information system. According to him, he was detected without his access being cut off, which allegedly allowed him to remain in place for several days. Enough to exfiltrate data quietly.

For its part, the Education Ministry is conducting an investigation, notably with help from ANSSI. Their statement specifies that all staff potentially affected by the July intrusion have already been informed individually. In addition, if the investigation establishes that students are concerned, their legal representatives will be notified.

France must react — enough is enough

The months go by, and it is always the same: state services fall victim to data leaks, one after another. It is depressing, but it is becoming hard not to think that another data breach is inevitable — we just do not know when, or which department or agency will be hit next. Worse still, France is reactive: it waits for a service to be hacked before launching a set of projects intended to strengthen the security of its information systems.

Following these various incidents, DGFiP has unveiled its roadmap. The measures mentioned are legitimate, but they need to move quickly, or more French data will end up out in the wild. Here is what is planned:

Roll out two-factor authentication to all agents by the end of the year.
Generalize consultation quotas, already applied to the FICOBA file, to cap how much a single account can extract.
Redesign detection to spot abnormal use of a valid account: login from an unusual environment, abnormal query volume, bulk requests against a database.
Bug bounty program and the use of AI to test systems internally (with sovereign AI).
Internal campaigns to test staff against phishing and strengthened training.

According to FrenchBreaches, Bercy reportedly mentioned situations in which accounts already protected by two-factor authentication could still have been compromised. This highlights an important point: MFA is not always enough. It significantly reduces risk, but phishing-resistant authentication methods should also be used (passkeys, FIDO2 keys, etc.). In addition, cookie theft may be enough to log in to a compromised account by reusing an authenticated session, which in turn bypasses MFA.

It is therefore wise to pay close attention to logins from suspicious locations, or even unusual devices, and to go as far as continuous identity verification with the right technical controls. Adding consultation quotas on databases is a good idea. At least if there is an intrusion, it could reduce data exfiltration. Today, on systems this sensitive, it is not normal for a single account to be able to query hundreds of thousands of records, let alone in just a few hours.

One heavier project still seems relevant to me: segmenting access to line-of-business databases. That would make it possible to apply the principle of least privilege to staff accounts. But the applications must have been designed for it. When that is not the case, it is far from simple (it requires a development phase).

What a hacker can really do with your tax data

When asked by AFP, ZeroBytes claims to have already resold the tax data to two buyers for several thousand euros. He also says he is interested in France because French organizations are "easy to hack". Now that taxpayers' tax data is out in the wild, it is fair to ask what a hacker can actually do with it... That is certainly the question the 678,000 affected people must be asking themselves.

Spoiler: the danger is not that your bank account will be emptied (the Finances publiques portals are not affected). However, this data helps scammers look more credible.

Phishing. A fake adviser who cites your reference tax income, number of parts, and latest exchanges with the administration no longer looks like the sloppy phishing email sent in a hurry. Mentioning your personal data helps the scammer appear credible.
Identity theft, but not on its own. DGFiP classifies this as a more marginal risk, for one reason: it assumes the attacker also obtains a copy of your identity documents elsewhere. Tax data alone is not enough to open an account in your name.
The accumulation effect, the real issue. A reference tax income does not allow someone to get a loan from a bank. Combined with an IBAN from the January FICOBA leak, an address from the cadastral data, and contact details from another breach, it creates an accumulation effect. By combining data from several leaks, a scammer can build a complete dossier on their target (as long as they are actually able to do it).

In response, here are some practical steps:

Check accounts opened in your name. The FICOBA file lists all accounts opened in France. Since January 6, 2025, access requests are made directly from your personal space on impots.gouv.fr.
Check loans taken out in your name. The Central Check File (FCC) and the file of loan repayment incidents for individuals (FICP) can be consulted from your personal account on the Banque de France website via FranceConnect.
Use secure messaging. For any exchange with the tax administration, the messaging feature in your impots.gouv.fr account avoids the minefield of emails and phone calls.
Report it and file a complaint. Any fraud attempt should be reported on cybermalveillance.gouv.fr. If you suffer harm, complaints can be filed through the THÉSÉE platform or at a police station. DGFiP has also opened a dedicated hotline at 0809 401 401.

Finally, remember that the administration will never ask for credentials, passwords, or bank details by email, text message, or phone.

To conclude, here is the list of articles and sources used to write this article:

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio