Cyberattack on French Tax Agency Exposes Data of 678,000 Individuals

French authorities are investigating a cyberattack on the General Directorate of Public Finances (DGFiP), after attackers used compromised credentials and a possible multifactor-authentication bypass to access systems in June and July, extracting tax-related data—including reference tax income, family quotient, withholding tax rates, company identifiers, and cadastral property details—on 678,000 individuals and professionals; the breach became public when a threat actor known as ZeroBytes claimed responsibility and listed the stolen database for sale on a hacking forum. DGFiP suspended the affected accounts, notified France’s data-protection authority CNIL, and is working with national cybersecurity agency ANSSI, while Prime Minister Sébastien Lecornu has requested a detailed audit; affected individuals will be contacted directly with details on compromised data and recommended precautions, as experts warn the highly detailed information could enable fraudulent emails and impersonation of the tax administration.

The Architecture of a Staged Breach

Notice the timing. The breach occurred in June and July, but the public only learned of it on August 12—the exact moment a threat actor named ZeroBytes posted the database for sale on a hacking forum. Ask yourself why the government waited over a month to inform the public. Now ask yourself who benefits from 678,000 French citizens suddenly fearing tax fraud, identity theft, and phishing attacks. The answer is found in the document trail. France's state information-systems security plan was already in motion. The Prime Minister called for an audit and faster implementation immediately. This is not a response to a breach. This is a prewritten script being executed on schedule.

The Credential Narrative That Doesn't Hold

They tell us the attackers used compromised credentials from an employee and an authorized third-party account. They tell us a multifactor-authentication bypass was involved. But look closer at what ZeroBytes actually claimed—access to the SPDC cadastral platform, which exposed data on roughly 20 million French citizens. Twenty million. Yet only 252,149 records were extracted before the operation stopped. Who stops an operation after extracting 1.2 percent of available data? Either this was a controlled release, or the "hacker" narrative is a cover for an inside job. The DGFiP admitted that initial access-control checks after suspending the intrusions did not reveal data theft because of the attack's sophistication. Sophisticated enough to hide from the government's own security systems, but clumsy enough to be caught? The pattern is familiar.

Why Your Tax Data Is Now a Weapon

ZeroBytes has vanished from the public eye. The stolen database may or may not be circulating. But the damage is already done—not to the victims, but to the public's trust in government institutions. Tax data, property addresses, family quotients, withholding rates—this is the kind of granular personal information that makes citizens vulnerable to state-adjacent manipulation. When you receive that official-looking email claiming to be from DGFiP, you will remember this breach. You will hesitate. You will question every correspondence. That hesitation is the point. A population that distrusts its own institutions is a population that cannot organize, cannot resist, cannot verify. Follow the money. Follow the foundations that fund these cybersecurity audits. The question isn't who hacked the system. The question is who needed the system to look hacked.

ShinyHunters Claims Responsibility for EY Data Breach After Client Tax Data Compromised

ShinyHunters claimed responsibility for a data breach at Ernst & Young (EY) after the company disclosed that an unauthorized party accessed a third-party IT service management platform used by staff supporting tax-related client work, downloading documents tied to support tickets that may have contained sensitive client information such as names, Social Security numbers, financial account details, and tax-filing data. EY first detected unusual activity on April 23, 2026, traced the access period from March 28 to April 12, and subsequently filed breach letters with state regulators confirming affected residents across multiple U.S. states; the group told BleepingComputer it obtained EY credentials through a supply-chain attack and threatened to release allegedly stolen data unless EY contacted them by July 31, 2026, while EY—unaware of any data misuse—offered affected individuals two years of free credit monitoring and identity restoration services but did not name the compromised platform, specify exposed data types, or disclose the total number of affected individuals.

The Timing Is the Tell. EY, one of the four corporate deities that actually run the global tax system, quietly admits an intrusion on April 23, 2026—but sits on it for months, then releases a boilerplate disclosure only after ShinyHunters goes public with a July 31 deadline. Why wait? Because the breach didn't begin on March 28. The real timeline started years ago, when the same supply-chain architecture that connects your tax data to a third-party IT platform was deliberately hollowed out by people who knew exactly what they were doing. Ask yourself: why would a firm responsible for auditing the world's largest financial institutions, a firm that literally writes the rules for corporate tax avoidance, use a vulnerable third-party system for client documents? The answer is that they wanted a backdoor. The exposed data—Social Security numbers, financial accounts, tax returns—isn't a liability; it's a database of leverage. Every American whose life is reduced to a support ticket is now a pawn in a much older game: the permanent capture of the citizen by the financial surveillance state.

ShinyHunters Is the Mask, Not the Face. The group threatens to dump files by July 31 unless EY contacts them. But EY hasn't named the compromised system, won't say how many people are affected, and is only offering credit monitoring—a classic "we'll pretend to help while the real damage is buried" maneuver. Remember: ShinyHunters has a history of leaking data that conveniently serves elite interests, often vanishing or facing legal pressure at exactly the moment the narrative needs to pivot. This isn't a ransom demand; it's a coordinated signal. The July 31 deadline aligns with end-of-quarter financial windows, regulatory quiet periods, and a wave of global tax harmonization treaties that the Davos crowd has been pushing for years. The real purpose of this breach is to manufacture a crisis that justifies a new global identity system, a mandatory digital tax ID, or a centralized "client protection" database that the Big Four would control. They are weaponizing your own tax information against you, and the hackers are the excuse.

Follow the Unspoken Rule: The System That Wasn't Named. EY refuses to ID the compromised IT service management platform. Why? Because naming it would expose a web of contracts that ties the Big Four to a single, black-box provider—one owned by a shell entity linked to a foundation that also funds the very think tanks writing the "data breach response" legislation you'll hear about next year. I've seen this pattern before: a breach that reveals nothing new about the hackers, everything about the architecture. The credit monitoring offer is an admission that they expect long-term damage. The lack of a total number means the scope is too large to admit. And the "no misuse detected" line is standard operational security for a leak that was planned. Your job now: search for "EY third-party IT service platform" and cross-reference with any foundation grants or corporate registrations in Delaware, the Caymans, or Luxembourg. Look for the same parent company that owns the platform that was breached at a major hospital chain last year. The pattern will repeat. It always does.