On Thursday evening, August 13, France’s Ministry of Economy and Finance confirmed that taxpayer data, belonging to both individuals and businesses, was stolen in a cyberattack. The admission came a day after the attacker posted on a cybercrime forum claiming to have breached the tax authority’s system (DGFiP). According to the ministry’s statement, the access occurred in late June 2026, following an identity theft, and was cut off at the end of that month during a routine security check. But before the access was cut, the attacker managed to view and extract data.

FrenchBreaches, a platform that obtained the data directly from the attacker, reports 678,438 lines of data, of which 392,867 relate to individuals and 285,570 to businesses and self-employed professionals. The leaked sample includes internal tax identifiers, full names, dates and places of birth, addresses, household composition, number of dependents, reference taxable income, withholding tax rates, phone numbers, email addresses, and even logs of individual citizen requests to the administration, such as address changes. Among those affected are 26,805 taxpayers with an income of 100,000 euros or more, 386 with an income above one million euros, and eight with an income above ten million euros. The ministry has not confirmed these figures, only the fact that data was stolen.

They Got In Using Someone Else’s Identity, Not by Breaking the System

The most interesting part of this story isn’t the scale of the damage, it’s how the attacker got in. Based on what’s known so far, this wasn’t a software flaw or an unpatched exploit, it was identity theft that gave the attacker access to an internal VPN, and through it, to an internal search tool covering data on citizens and businesses. Once inside, the attacker began automating data extraction, and the operation was cut short only when the system flagged it as suspicious behavior.

That’s the key difference from a classic hacking scenario. The outer defenses weren’t breached, someone used another person’s identity to walk through a door that was legitimately open for that identity. For institutions handling sensitive citizen data, that means identity verification and limiting how much a single user can see at once become just as important as the external firewall, if not more so.

Seven Weeks of Silence

The timeline of this case deserves particular attention. Access was cut off at the end of June, but the public, and CNIL, France’s data protection regulator, didn’t learn about the incident until August 12, when the attacker themselves posted the data on a forum. That’s nearly seven weeks of silence, even though the administration knew internally that something had happened. Only after the attacker published the stolen data publicly did the ministry issue a statement, notify CNIL, and announce it would file a criminal complaint.

The situation got more complicated less than 48 hours later. The same attacker, going by the name Zerobytes, claims to have carried out a second intrusion, this time into the tax authority’s cadastral API. If true, that means the system failed to close every door the same actor could walk through, even after the first breach was discovered, which raises serious questions about how fast and how thoroughly the response actually was.

This incident isn’t an isolated case in the French public sector this year. In January and February, an attacker used a government official’s stolen credentials to access France’s FICOBA bank account registry and view data from 1.2 million accounts. A month later, France’s health ministry admitted that software from Cegedim Santé, used by roughly 1,500 medical practices, had been hacked, exposing administrative and medical data for more than 15 million people, including sensitive notes for 169,000 patients. In all three cases, the problem wasn’t a broken outer wall, it was the abuse of something that already had legitimate access, whether stolen credentials, third-party software, or a false identity.

What This Means for Croatian Institutions

Croatia’s tax administration, HZMO, HZZO, and the e-Građani system handle the same kind of data as France’s DGFiP, for millions of citizens. This case points to three things every public body categorized as an essential or important entity under the ZKS should check.

First, identity and privileged access management. If someone can walk into an internal data search tool simply by posing as an authorized person, identity verification at that point clearly wasn’t strict enough. Multi-factor authentication and tight control over exactly who can access which tool aren’t technical footnotes, they’re the baseline of defense.

Second, detecting unusual behavior. Automated extraction of thousands of data lines looks nothing like normal system use, and the system should catch that long before an attacker announces they’re inside. Seven weeks between the internal access cutoff and the public admission suggests that monitoring and anomaly detection need more attention, not just as technology but as an escalation process.

Third, the speed and thoroughness of post-incident remediation. If the same attacker managed to get back in through a different system less than two days after the first breach came to light, closing one hole clearly wasn’t enough. An incident response plan needs to check every system that shares the same authentication infrastructure, not just the one that was directly hit.

Riskoria helps public bodies and critical infrastructure operators in Croatia with ZKS compliance assessments, identity and privileged access management, and cybersecurity audit preparation. To discuss your institution’s current state, reach out at info@riskoria.eu.