France’s Finance Ministry has confirmed that data belonging to individual and professional taxpayers was viewed and extracted during a cyberattack on systems operated by the Directorate General of Public Finances, known as DGFiP. Reuters reported on August 14, 2026 that the ministry later said data from 678,000 users had been stolen. Investigations are continuing to determine the exact data fields involved and the full scope of the incident.
Unauthorized access occurred in late June
According to the timeline described by the ministry, a malicious actor claimed to have entered the French tax agency’s systems in late June. Investigations carried out by the authorities confirmed both the cyberattack and the consultation and extraction of taxpayer data. The incident became public in mid-August. Reuters said the ministry initially reported that it was still working to identify the precise types of data involved and the number of taxpayers affected, before later giving the figure of 678,000 users.
What has been confirmed and what remains unclear
The official confirmation establishes that records linked to both individuals and professional taxpayers were affected. The ministry’s initial public statements did not, however, provide a complete list of every stolen data field. Le Monde also reported on August 14 that the ministry had acknowledged the breach while questions remained about its full extent. Claims that go beyond the number and circumstances confirmed by the ministry should therefore not be treated as established facts while the investigation remains open.
Individual notices for affected users
The ministry said users affected by the breach would be contacted individually. According to the statement reported by Reuters, those notices are expected to identify the data that may have been viewed or extracted and, where relevant, specify precautionary steps. Officials also said further findings would be disclosed as the investigation progresses. The distinction matters because a general breach announcement does not establish that every affected user had exactly the same categories of information exposed.
The investigation is still active
Technical and administrative inquiries are continuing. The number disclosed by the ministry indicates the reach of the incident, but it does not by itself explain every part of the attack. In investigations of public-sector data breaches, authorities commonly separate the method of access, the length of time an intruder remained in a system, the records that were viewed and the files that were actually extracted. In this case, the central verified finding is that unauthorized access to DGFiP systems resulted in taxpayer information being consulted and removed.
At the time of publication, the ministry’s position was that directly affected people would receive individual information and that more details would be released once the inquiry produced firmer results. That makes official notices and subsequent ministry updates the most reliable sources for determining whether a particular user was affected and which records were involved. For now, 678,000 remains the updated figure attributed directly to the French Finance Ministry by Reuters, while the precise data set and the broader technical circumstances are still under examination.
