The cybercrime unit of the Paris Prosecutor’s Office is investigating how sensitive information was illegally extracted from a government system containing personal data. Tax officials described the attack as highly sophisticated and more serious than previous attacks against the agency.
The investigation has been handed over to France’s national agency responsible for combating cybercrime.
Prosecutors said the investigation is also looking into individuals suspected of being involved in a criminal group that allegedly organized the attack, an offence that could carry a prison sentence of at least five years.
The attack allowed cybercriminals to access information belonging to 678,000 people and businesses who use France’s tax administration services.
Tax authorities said the attack was more serious and complex than previous incidents targeting the agency, raising fresh concerns about the security of government systems that store sensitive personal information.
The stolen information includes taxpayers’ full names, tax-related personal details, taxable income and the tax rates applied to them, according to Amélie Verdier, Director General of Public Finances.
However, France’s General Directorate of Public Finances (DGFiP) stressed that the stolen information does not allow those who obtained it to access taxpayers’ protected accounts.
Authorities said affected individuals will begin receiving notifications at the beginning of next week. They will be warned about the risk of identity theft and advised to remain vigilant against attempts to trick them into providing additional personal information.
The incident comes amid growing concerns over cyberattacks targeting government institutions in France, highlighting the increasing challenge authorities face in protecting sensitive public data from increasingly sophisticated cybercriminals.
