DGFiP data breach: are your tax logins affected?

A data breach that changes how convincing a scam can look

Updated 5 October 2026, following publication of the ANSSI report on 29 September. The DGFiP reported illegitimate access to its information system in June, July, and August, followed by claimed data thefts on 12 and 13 August. ANSSI traced activity observed between May and August and described two data-exfiltration scopes: data associated with the impots.gouv.fr platform and cadastral data held by the DGFiP. The DGFiP says that the impots.gouv.fr website and taxpayers' public and professional tax spaces were not compromised. These spaces must be distinguished from the platform and internal systems covered by the report.

The DGFiP page also describes a vulnerability discovered on 17 August in the Vacant Estates portal, which contained only public data. This is separate from the illegitimate access described in the ANSSI report.

The 14 August statement says data concerning 678,000 individuals and businesses was viewed or extracted, including reference tax income, family quotient, withholding-tax rate and, for businesses, legal name or SIREN. It also says property-register data was viewed. The DGFiP FAQs distinguish the two scopes: for individuals, data may include tax ID, civil status, contact details, tax status and the list of messages exchanged; message contents may have been accessed for fewer than 250 individuals, without attachments. For businesses, data includes the SIREN, company name and address, plus message metadata; message contents may have been accessed for fewer than 2,076 businesses, without attachments. Business tax returns and payments were not accessed. See the official DGFiP FAQs for individuals and businesses for details.

One point needs to remain explicit: the DGFiP says that impots.gouv.fr, public and professional tax spaces, and their passwords were not compromised. There is therefore no need to change a tax password because of this incident. Change it if it was reused on another breached service or there is another indication of exposure. This does not remove the phishing risk, but it avoids implying that attackers accessed taxpayers' accounts.

What the ANSSI report established

ANSSI attributes the compromise of DGFiP systems to combined weaknesses in three areas. Legitimate credentials were stolen after being used on personal devices, then used on sensitive portals without strong authentication. Some sensitive applications were exposed to the Internet or reachable from the French Interministerial Network without sufficient separation, increasing their exposure and opening a path for lateral movement from other organizations' resources, as happened through the Ministry of Education. Finally, neither DGFiP nor ANSSI monitoring detected either wave of data exfiltration.

The report notes that one portal used to extract information was not monitored by the DGFiP and that suspicious signals were not correlated. It shows how identity protection, access limits, and the ability to spot unusual activity work together. The report does not reduce the incident to a password problem.

Why accurate information makes phishing more dangerous

A fake tax message rarely succeeds on appearance alone. It becomes more persuasive when it includes an accurate detail: a company name, a SIREN, a reference to a real process, or a plausible tax period.

Those details do not automatically grant access to an account. They do reduce doubt when someone receives an email, text message, or phone call. The attacker can then ask for a login, an identity document, a payment, or a verification code under the pretext of a correction or a refund.

For an SMB, the exposure is twofold. A person may be targeted as an individual and as a company representative. A message combining one accurate personal detail with one known business detail can feel legitimate enough to bypass normal caution.

What to do when a message mentions taxes

• Do not use the link or phone number supplied in the message. Open impots.gouv.fr or the usual professional tax space yourself.
• Never share a password, an SMS code, or an MFA approval because an unexpected caller asks for it.
• Verify the request through a known second channel, for example with the accountant or the person who manages access.
• Keep the message, its headers where possible, and useful screenshots before reporting it.
• If there is doubt or harm, use the official services listed by the DGFiP, including 17Cyber, PHAROS, or Cybermalveillance.gouv.fr.

The DGFiP says it has individually informed affected people. An email mentioning the real breach is therefore not trustworthy merely because it refers to a genuine incident. For general steps after an exposure, see our guide to responding to a data breach.

Three checks for an SMB

The report gives smaller organizations a reason to check whether their protections cover real usage, not just the most visible accounts and tools:

1. Protect identities: require multifactor authentication for sensitive access and control access to work portals from personal devices.
2. Limit access paths: review which accounts and applications can reach sensitive data, then separate environments and partner access according to actual need.
3. Make activity observable: list applications that process or export data, retain useful logs, and check that alerts can connect suspicious signals.

These controls complement password management. They do not replace a risk assessment suited to the system or help from a security professional when the organization lacks the necessary expertise.

The limited role of a password vault

A password vault helps with one part of the problem: each login can have a unique secret without copying it into a shared document or notebook. For a tax or business account, a team can:

1. Generate a random, sufficiently long secret that is different from every other password.
2. Keep it in an encrypted vault, with access limited to people who need it.
3. Enable multifactor authentication when the service offers it.
4. After a compromise, change the secret from a clean device and separately check active sessions and access with the service.

Soclyde helps generate unique secrets and keep them in an encrypted local-first vault. This can reduce password reuse and centralized copies. A vault does not detect data exfiltration, separate applications, or protect a compromised personal device; those protections also depend on service settings, endpoints, and the wider information system.

What to remember

A data breach does not necessarily hand over the keys to an account. It can still provide the context that makes social engineering more credible. The response therefore needs two layers: verify requests through an independent channel, and make every critical login unique, long, and difficult to copy.

For a small team, the lesson goes beyond password choice: protect identities, reduce unnecessary access, and check that important applications are monitored. To organize secrets, see our guide to strong, unique passwords and guide to local-first password managers, or talk to Soclyde about your password strategy.