France's tax agency got hacked: how did it come to this?
France's tax agency got hacked (in French)
In mid-August 2026, France's tax agency (DGFiP) confirmed a major data breach exposing personal and financial information of 678,000 individuals and businesses. The attacker accessed the system via a compromised VPN account, and the data was sold on the darknet before the breach was detected. This incident follows a pattern of repeated cyberattacks on French state services, raising questions about systemic security weaknesses, delayed detection, and the adequacy of France's cybersecurity strategy. The article analyzes the technical and organizational failures, compares with a landmark EU court ruling on state liability from a Bulgarian case, and calls for a renewed focus on technical expertise over bureaucratic compliance.
The problem is not that an attacker can get into a system, that will always happen; the problem is that a compromise takes so long to be detected and gives access to far too many things.