French government confirms mass data breaches at tax and land registry agencies
Prime Minister Sébastien Lecornu orders the creation of a new cyber unit after hackers stole financial data from over 878,000 accounts, with a third breach detected in August.
French authorities have confirmed that cybercriminals stole detailed financial information from the Public Finance agency (DGFiP) and land registry systems during June and July. The agency’s head, Amélie Verdier, stated that a further data breach was detected on 17 August and is currently under evaluation. The disclosures mark a significant escalation in the series of attacks targeting French state infrastructure this year.
The first incident in June compromised data from more than 678,000 individual and professional accounts, including names, income reference data, and tax rates. A second attack in July affected 200,000 land registry accounts. The hacking duo ZeroBytes claimed responsibility for the thefts on a dark-web forum, stating they had accessed a VPN used by tax officials.
ZeroBytes, a self-proclaimed French hacking group, stated they had no particular motivation other than money. The duo claimed to have obtained information on millions of students and tens of thousands of teachers, with some data dating back 20 years. They also asserted they had already sold the stolen information to two individuals for thousands of euros.
In response to the breaches, Prime Minister Sébastien Lecornu requested that the National Cybersecurity Agency establish a new cyber unit to counter such attacks. This move follows a period of intense cyber activity, with experts describing France as one of the countries most targeted by cybercriminals.
Budget Minister David Amiel announced that his ministry will use artificial intelligence tools to test the cybersecurity vulnerabilities of government agencies. He emphasised that the government would only work with sovereign AI providers, such as France’s Mistral, and explicitly excluded US-based OpenAI from these operations.
The latest incidents follow a string of major breaches in 2026. In April, the identity document agency ANTS was hit by an attack affecting nearly 12 million individuals. In February, a breach of the finance ministry resulted in the theft of details for 1.2 million bank accounts, followed shortly by the theft of medical information for approximately 15 million individuals.
