France’s Tax Agency Loses Data on 678,000 People to Stolen Login
The French tax agency (DGFiP) suffered a data breach in June and July, exposing income and property data on 678,000 individuals and businesses. Attackers gained access using stolen staff login credentials and those of an authorized third party, not through software vulnerabilities. Despite cutting off access, the agency only discovered the full extent of the theft when the hacker advertised it in August.
The Breach Details:
- Exposed Data: Reference tax income, family quotient, withholding tax rate, registered business name, SIREN number, and cadastral records.
- Avoided Areas: Personal or professional accounts on impots.gouv.fr were not compromised; no taxpayer usernames or passwords were stolen.
How the Attackers Got In:
Credentials theft was the method employed, not a zero-day exploit. The attackers bypassed multi-factor authentication, according to Help Net Security. This breach highlights the growing importance of login credentials as the main point of access.
DGFiP’s Response:
Upon detection, DGFiP immediately terminated all affected accounts. However, the sophistication of the attack led to a missed detection during initial access checks. Following the revelation by the hacker on August 12-13, the agency launched in-depth investigations, confirming the compromised data reached 678,000.
The Hacker’s Claim:
A user named ZeroBytes claimed ownership of the data on a cybercrime forum, offering it for sale. However, external verification is impossible due to DGFiP’s assertion that all access was terminated upon detection.
Discrepancies in Data:
ZeroBytes alleged control over roughly 20 million French citizens’ records, claiming to have extracted 252,149 records covering more than two million people. In contrast, DGFiP stands by its figure of 678,000 individuals and businesses affected.
Ongoing Investigations:
DGFiP continues its investigations, aiming to pinpoint the exact volume of extracted data and the final number of users impacted. The breach echoes a similar incident in June with France’s sovereign messenger, where there was disagreement between officials and the hacker regarding the severity.
Prime Minister Sébastien Lecornu chaired an interminable crisis meeting to address this latest data breach.