France's tax authority had data stolen on 680,000 taxpayers
France's tax authority had data stolen on 680k taxpayers
A hacker known as ZeroBytes claims to have stolen data on 680,000 taxpayers from France's tax authority, DGFiP, in late June. The breach, which the government confirmed after the hacker's forum post, exposed names, addresses, and property details but no passwords or banking info. It's the second major breach for the agency this year, following a January attack on the FICOBA bank account database. Authorities are investigating, and affected individuals are advised to be wary of phishing attempts.
An accurate address and a correct date of birth no longer prove anything at all.
- orwin
I worked as a temp for france tax collection before my degree (circa 2012-2013l.
People were registered in 3 different database, each of them independent, each of them on a different software (one aspnet/vbnet you connected through a browser, one very, very old, clearly IBM software, and the third one was probably as old as IBM, if not older, but looked like a minitel portage on windows). All the relevant data were dispersed on those three (a fourth one existed but only authorised people could use it because you had bank account numbers on it). Also, only the Vbnet software allowed copy paste, which means that to find someone, you had to file the tax number+surname 3 time, without making any mistake.
I wonder which one was broken into. No bank details, so it probably was one I had access to as a temp. Maybe they upgraded their software though, because if I remember correctly only they all worked on the local network (not sure about the aspnet one).
- falcor84
It was really hard for me to parse that headline. I'd instead suggest:
Hacker claims exfiltrating data on 680,000 French taxpayers.
- peri-cl
> "The attack is not recent, however. It dates back to late June - the 26th, to be precise, according to the hacker - and the administration had detected and stopped it at the time, without ever saying a word publicly."
I thought GDPR mandated disclosure of data breaches involving PII. Is France's tax authority somehow exempt?
edit to add: Article 33 particularly,
https://gdpr.eu/article-33-notification-of-a-personal-data-b...
- xabd
680k taxpayers is a pretty significant number. I wonder what kind of data was actually exposed and whether the affected people are being notified individually.
- apopapo
These are the same people who want to identify you whenever you interact with a "social media" website.
I will never comply.