Tax income figures, family quotients, withholding rates, business SIREN numbers, and cadastral property records for 678,000 people and professionals left internal French tax systems through sessions that should never have belonged to an outsider. The French DGFiP tax authority breach hinged on usurped login identifiers belonging to a DGFiP internal agent and an authorized third party. The threat actor ZeroBytes claimed stolen credentials plus an MFA bypass, then used live authenticated access to internal tax and cadastral systems in June and July 2026 until those access points were interrupted. Consumer-facing tax portals and end-user passwords were not compromised.
How usurped DGFiP agent and third-party identifiers opened internal systems
According to BleepingComputer, France’s Direction générale des Finances publiques (DGFiP), under the Ministry of the Economy and Finance, confirmed unauthorized access after ZeroBytes publicly claimed the intrusion. On 12 August 2026 the actor listed a stolen database for sale on PwnForums. Official investigation and disclosure followed, with ministry follow-up numbers reported around 17 August 2026.
The confirmed entry path is identity usurpation, not a smash-and-grab on public citizen logins. Officials stated that login identifiers of an internal DGFiP agent and an authorized third party were abused. ZeroBytes claimed those credentials, combined with an MFA bypass, allowed authentication to succeed and to persist. Public ministry statements confirm the usurpation. They do not name an MFA product, factor type, or a verified method. Treat the bypass detail as an attacker claim until a regulator or the ministry documents it.
That gap matters for anyone trying to reverse-engineer the control failure. Workforce and partner identifiers remained usable for interactive authentication to internal tax and cadastral systems. Whatever second factor sat on those accounts, if any path the attacker described worked, the login ceremony still completed for someone who was not the legitimate agent or partner. How those identifiers were first obtained has not been publicly detailed. Filling that blank with phishing kits, helpdesk resets, or malware would be invention.
Once the usurped identities authenticated, the rest of the story is ordinary privileged use of systems that trust a successful login. There is no public description of a separate cookie-stealing malware implant, Golden SAML forgery, or OAuth consent scam. The damage path was live access under the stolen workforce and third-party personas.
| Control surface | What reporting shows | Why it failed here |
|---|---|---|
| Consumer tax portals | Not compromised | Attack used internal/partner IDs |
| Agent and third-party logins | Usurped and used | Identifiers still minted real sessions |
| MFA on those logins | Bypass claimed by actor | Method unverified; product unknown |
| Post-login data access | Queries and extraction | Auth already succeeded |
What the live sessions pulled before DGFiP cut access
According to the French Finance Ministry and DGFiP, quoted via BleepingComputer, prior to interruption those access points had been used to consult and extract data concerning 678,000 individuals and professionals. The haul included tax data such as reference tax income, family quotient, and withholding tax rate, and for businesses company name and SIREN number. Cadastral addresses and property sizes were also in scope of the broader internal access narrative.
The ministry’s own clarification is easy to miss in headline noise: online accounts of individual and professional users were not compromised, and user IDs and passwords were not compromised. The blast radius is still severe. Reference income and withholding rates are high-value identity and fraud fuel. SIREN-linked business records and property descriptors compound that for professionals and landowners. The count that officials stand behind is 678,000 affected people and professionals, not the larger panel figures the actor advertised.
ZeroBytes also claimed partial SPDC cadastral extraction and ongoing panel access, including a boast that scraping roughly 20 million citizens’ worth of exposure would have taken months and that the actor was “still logged into the panel.” Those larger exposure and “still logged in” claims remain attacker statements. Confirmed ministry impact stays at 678,000. The actor’s own forum language, as reported by BleepingComputer, even admitted extraction stopped because scraping was “horrible” and slow, then offered panel access for sale with the database. That is marketplace theater layered on top of real confirmed access, not a second official victim count.
Timeline shape is clearer than the MFA mystery. Unauthorized access sat in the June and July 2026 window. Public claim hit 12 August 2026. From that point DGFiP and the ministry investigated, interrupted abused access points, and shut down sensitive access. Abused accounts were suspended. CNIL was notified and ANSSI engaged. Victims are being contacted. Containment was account and access shutdown after the fact, which is exactly what you do when the session was already legitimate from the system’s point of view.
This incident also sits in a noisy stretch of French public-sector breach reporting. The same BleepingComputer piece frames nearby cases including the France Travail employment agency breach, a FICOBA national bank account registry incident under the wider finance perimeter, and a France Titres / ANTS secure-documents database claim. Those are adjacent context in the same news cycle. No proven operational link to the DGFiP intrusion has been established in the public reporting used here, so they should not be welded into one campaign story.
What identity usurpation proves when the MFA path stays opaque
The hard lesson is split across two moments, and only one of them is an authentication problem.
First moment: initial access. Stolen or usurped workforce and partner login identifiers were enough, in the attacker’s telling with an MFA bypass claim, to authenticate to internal systems. Officials confirm the identity usurpation. They do not confirm how any second factor was handled. Still, the operational fact is brutal. An outsider completed login as an agent and as an authorized third party and kept working until defenders interrupted those paths. Interactive trust in those identifiers was the hinge. Passwords and classic second factors only help if they cannot be stolen, relayed, fatigued, recovered, or otherwise completed by the wrong person. Public detail does not say which of those happened. It does say the wrong person got a real session.
Second moment: data access. After authentication succeeded, the live sessions were used to consult and extract records. No separate post-authentication token theft path is described beyond that live use. At that stage the system is doing what authenticated users are allowed to do. No login control revokes a session that already exists and is busily querying tax and cadastral backends. Prevention value sits upstream, at stopping the usurped identities from minting trusted sessions in the first place. Detection, account suspension, and access shutdown are what limited further damage after the fact.
For security teams, that split should kill two bad habits. One is assuming every government data leak is “the citizen portal got stuffed.” Here the ministry explicitly said user-facing accounts and passwords were not the prize. The other is treating an unverified MFA bypass claim as a named technique class you can patch by buying one gadget. You cannot inventory a method the victim has not documented. You can inventory whether agent and partner logins still depend on transferable secrets, whether third-party access is over-privileged for bulk consult-and-export, and whether “authorized third party” accounts get the same monitoring intensity as staff.
Device-bound, origin-bound authentication aimed at the full workforce and partner lifecycle is the direction that removes the transferable-credential surface this class of breach lives on. It does not rewrite history for a session that already authenticated and queried data. It also does not require inventing how ZeroBytes handled MFA when that method is still opaque. It requires admitting that any login path that can be completed with stolen identifiers and a defeatable second factor is still a workforce identity problem, not a consumer CIAM problem.
If you want the prevention angle on stopping this class of workforce and partner login usurpation, read how phishing-proof MFA addresses DGFiP-style agent and third-party login usurpation.
FAQ
Were ordinary French taxpayer online accounts hacked in the DGFiP breach?
No. According to the French Finance Ministry and DGFiP via BleepingComputer, the online accounts of individual and professional users were not compromised, and user IDs and passwords were not compromised. The French DGFiP tax authority breach abused usurped identifiers of an internal agent and an authorized third party against internal tax and cadastral systems, not citizen portal passwords.
How did ZeroBytes get into DGFiP systems according to public reporting?
Public reporting says ZeroBytes authenticated using usurped login identifiers belonging to a DGFiP internal agent and an authorized third party. The actor claimed stolen credentials plus an MFA bypass. Officials confirm identity usurpation but have not published a verified MFA product name or method. Access then used those live authenticated sessions to consult and extract data until the abused access was interrupted.
How many people were affected in the DGFiP breach, and what data left?
The confirmed figure from the French Finance Ministry and DGFiP is 678,000 individuals and professionals. Extracted data included reference tax income, family quotient, withholding tax rate, business names and SIREN numbers, and cadastral property-related records. Larger SPDC or “about 20 million” exposure figures promoted by ZeroBytes are attacker claims and are not the ministry’s confirmed affected count.
Did MFA fail in the DGFiP incident?
Something on the authentication path failed enough for usurped agent and third-party identities to obtain real internal sessions. ZeroBytes claimed an MFA bypass. Ministry statements confirm usurpation without detailing or verifying that claim. After login succeeded, data access was ordinary use of authenticated sessions, which no MFA control undoes by itself. DGFiP’s documented response included suspending abused accounts and shutting sensitive access after detection.
Is the DGFiP breach the same campaign as France Travail, FICOBA, or France Titres?
No proven operational link has been established in the public sources used for this write-up. Those incidents appear in the same recent French public-sector breach coverage, including the BleepingComputer report on DGFiP, but adjacency in news cycles is not the same as shared tooling, shared initial access, or shared operators tied to ZeroBytes and DGFiP.
Updates
2026-02-18: Prior related incident
Officials documented that DGFiP’s FICOBA registry was queried with stolen civil-servant credentials in late January 2026, exposing roughly 1.2 million accounts, and have not established any link to the June–July ZeroBytes tax-system intrusion.
Source: impots.gouv.fr, FICOBA
