ZeroBytes Sale Claim and DGFiP Tax-Data Breach in France
Case score 78
Case score is a discovery signal based on public evidence, not a guaranteed risk rating. Use it to decide what to review first, then verify important details from the linked sources.
- Total
- 78
- Main story score
- 78
- Related evidence lift
- +0 / 20
- Contributing updates
- 0
- Context updates
- 1
- Data Leak Anchors the breach through the ZeroBytes sale claim, the DGFiP victim identity, the SPDC access claim, and the disclosed extraction count. main
- Incident Adds official disclosure, shutdown of sensitive systems, CNIL notification, ANSSI involvement, and victim-notification timing for the same breach. context
Overview
Latest development Open development history ZeroBytes lists a stolen DGFiP database for sale on PwnForums On August 12, 2026, a threat actor using the ZeroBytes handle claimed access to General Directorate of Public Finances (DGFiP) systems, listed a stolen database for sale on PwnForums, and said they had also accessed the Serveur Professionnel de Données Cadastrales (SPDC), the French tax authority platform for central land registry and property ownership records.
-
French Finance Ministry discloses DGFiP data breach and shuts down sensitive systems
The French Ministry of the Economy and Finance disclosed that attackers accessed DGFiP systems and extracted data concerning 678,000 individuals and professionals, including tax and cadastral records; the ministry said online accounts, user IDs, and passwords were not compromised, DGFIP notified CNIL, and access to sensitive information systems was shut down while ANSSI helped assess the breach's full impact.
-
French Finance Ministry discloses DGFiP breach and shuts down sensitive systems
On August 17, 2026, the French Ministry of the Economy and Finance disclosed the DGFiP breach, said the tax administration had shut down access to sensitive information systems, notified the French Data Protection Authority (CNIL), and was working with ANSSI to assess the full impact; it also said affected individuals would be contacted starting the following week.