France’s tax administration has confirmed a significant cybersecurity incident involving unauthorised access to its information systems, exposing sensitive tax and personal information relating to more than 350,000 individuals and 250,000 businesses.
According to a FAQ issued by the Direction générale des Finances publiques (DGFiP) on 17 August 2026, the unauthorised access occurred during June and July 2026 following the theft or impersonation of credentials belonging to public-sector employees.
The compromised credentials allowed malicious actors to consult and extract certain information held within DGFiP systems. Separate unauthorised access to cadastral information was also identified.
The DGFiP says it became aware of the data theft on 12 August 2026, after the underlying fraudulent access had previously been detected and closed.
The incident is particularly relevant for tax professionals because the compromised information goes beyond basic contact data. It potentially includes tax identifiers, family and income-related information, withholding tax rates and records of communications with the French tax administration.
More Than 600,000 Individuals and Businesses Affected
According to the DGFiP, slightly more than:
- 350,000 individuals, and
- 250,000 businesses
are affected by the theft of sensitive data.
Affected taxpayers are being contacted individually by the DGFiP. Notifications began from 17 August 2026, initially by email and, where the administration does not hold an email address, by post.
The notification is being made pursuant to the information obligation under Article 34 of the General Data Protection Regulation (GDPR).
The communication will identify the categories of information that may have been accessed or extracted and, where appropriate, explain additional precautions taxpayers should take.
Importantly, the DGFiP warns that its notification does not contain a direct link to the taxpayer’s online tax account and does not request confidential information.
This is particularly significant given the risk that information obtained through the breach could subsequently be used to create highly convincing phishing or social-engineering attacks.
What Taxpayer Information Was Potentially Exposed?
The range of information potentially accessed is extensive.
For individuals, it may include:
- tax identification number;
- civil-status information;
- postal address;
- telephone number;
- email address;
- family situation;
- number of dependants;
- number of tax units or parts fiscales;
- revenu fiscal de référence;
- withholding tax rate (taux de prélèvement à la source); and
- the list of messages exchanged with the DGFiP through the impots.gouv.fr secure messaging system.
For fewer than 250 taxpayers, the actual content of messages exchanged with the tax administration may also have been accessed.
For businesses, compromised information includes data such as the company name and SIREN identification number.
The incident also affected certain cadastral information, including data relating to property addresses and surface areas.
The combination of tax, identity, contact and property information makes the incident particularly sensitive because such information could potentially be combined to make fraudulent communications appear legitimate.
Taxpayer Accounts and Passwords Were Not Compromised
The DGFiP has stressed that the personal and professional Finances publiques accounts on impots.gouv.fr were not themselves compromised.
Passwords used to access those accounts were not among the stolen information.
As a result, the administration says taxpayers do not need to change their impots.gouv.fr password specifically because of this incident.
Taxpayers can continue using their online accounts normally.
Nevertheless, the distinction is important: while account credentials were not compromised, other information obtained through the breach could potentially be used by criminals to impersonate the tax administration, banks or other trusted organisations.
Why Was the Data Breach Identified Only in August?
The fraudulent access itself took place during June and July 2026.
According to the DGFiP, those accesses were detected and closed during that period. However, at that stage, the administration had not established that data had actually been stolen.
The DGFiP explains that the extraction was carried out by circumventing normal channels, and the data theft itself was established only from 12 August 2026.
Once the breach was identified, the DGFiP says it:
- notified the CNIL, France’s data protection authority;
- filed a criminal complaint;
- began individually informing affected persons; and
- implemented additional security measures.
The Main Risk: More Convincing Fraud Attempts
The DGFiP considers the principal consequence of the breach to be an increased risk of phishing, fraudulent calls and social-engineering attacks.
Criminals possessing genuine tax and personal information may be able to make fraudulent approaches substantially more credible.
The administration specifically refers to risks including fraudulent manipulation involving supposed bank advisers or company executives.
An attacker could, for example, refer to genuine personal, tax or company information before requesting passwords, banking information, payment details or copies of identity documents.
The DGFiP also acknowledges the possibility of attempted identity theft. However, it notes that this would generally require criminals to obtain copies of identity documents from another source.
What Should Affected Taxpayers and Businesses Do?
The DGFiP advises individuals and businesses to exercise particular caution when receiving unsolicited emails, SMS messages, telephone calls, instant messages or social-media communications.
In particular, taxpayers should:
- never disclose passwords, identification codes or banking information in response to an unsolicited request;
- carefully verify the sender of messages;
- access their tax account by navigating directly to impots.gouv.fr rather than through links received in messages;
- independently verify information, particularly where a communication creates urgency or pressure to act quickly; and
- retain evidence such as messages, website addresses and screenshots where fraudulent use of information is suspected.
The DGFiP emphasises that the French tax administration never requests confidential information by email, SMS or telephone.
In cases of attempted fraud, taxpayers are advised to report the incident through France’s cybercrime reporting channels and, where a loss has occurred, file a complaint through the appropriate authorities.
DGFiP Introduces Additional Security Measures
The DGFiP says it immediately terminated access for the public-sector employee accounts used in the unauthorised activity.
Additional security measures have since been implemented, including preventive restrictions on access to sensitive information systems through portals used by public officials.
The administration has also strengthened monitoring of the tax accounts belonging to affected individuals.
Particular attention will be given over the coming months to potentially sensitive account changes, including modifications to:
- addresses; and
- bank account details.
The response involves not only DGFiP teams but also other parts of the French economic and finance ministries, including the Service du Haut fonctionnaire de défense et de sécurité (SHFDS) and the Agence nationale de la sécurité des systèmes d’information (ANSSI).
Why the Incident Matters for Tax Functions
The DGFiP incident illustrates an increasingly important dimension of tax digitalisation: tax authorities are accumulating and exchanging growing volumes of highly detailed taxpayer information while expanding digital interaction with individuals and businesses.
The information potentially exposed in this case includes not merely administrative identifiers but elements of taxpayers’ actual fiscal profiles.
For corporate tax and finance functions, the immediate issue is therefore not only whether systems or passwords were compromised. Businesses affected by the incident may need to consider whether employees responsible for tax, treasury, finance and payments could become targets of more sophisticated impersonation attempts using genuine company or tax information.
Organisations receiving a DGFiP notification may therefore wish to ensure that relevant finance and tax personnel are aware of the incident and apply established verification procedures to unusual requests involving tax payments, changes to bank details or access credentials.
The incident is also another reminder that, as tax administrations become increasingly digital and data-driven, cybersecurity and tax administration are becoming progressively interconnected compliance issues.
Frequently Asked Questions
How many taxpayers are affected by the DGFiP data breach?
The DGFiP states that slightly more than 350,000 individuals and 250,000 businesses are affected by the theft of sensitive information.
When did the unauthorised access occur?
The accesses occurred during June and July 2026 using compromised credentials belonging to public-sector employees.
When did the DGFiP discover the data theft?
The fraudulent access had been detected and closed earlier, but according to the DGFiP the actual theft of data was established only from 12 August 2026.
Were taxpayer passwords stolen?
No. According to the DGFiP, passwords for personal and professional Finances publiques accounts on impots.gouv.fr were not compromised.
Do taxpayers need to change their impots.gouv.fr password?
The DGFiP says a password change is not necessary as a consequence of this incident, although taxpayers remain free to change their passwords at any time.
What personal tax information may have been accessed?
Potentially affected information includes tax identification numbers, civil-status and contact information, family situation, dependants, tax units, reference taxable income, withholding tax rates and the list of messages exchanged with the DGFiP.
Were secure messages accessed?
The list of messages exchanged through impots.gouv.fr may have been accessed. For fewer than 250 taxpayers, the contents of messages may also have been subject to unauthorised access.
What information relating to businesses was affected?
The DGFiP identifies information including business names and SIREN numbers.
Was property information affected?
Yes. Certain cadastral information concerning property addresses and surface areas was also accessed.
How will affected taxpayers know?
The DGFiP began notifying affected taxpayers from 17 August 2026, by email or, where it does not have an email address, by post.
What should taxpayers watch for?
The principal risk identified by the DGFiP is fraud based on phishing or social engineering, where criminals could use genuine information obtained through the breach to make emails, calls or other communications appear credible.
What measures has the DGFiP taken?
The DGFiP says it disabled the affected employee-account access, implemented additional security restrictions, strengthened monitoring of affected tax accounts, notified the CNIL, filed a complaint and engaged with other French cybersecurity and government security authorities.