French tax office (DGFiP): tax data breach (2026)
Trustworthiness
Established by a regulator
- accounts
- 678,000
- Breach happened
- 13 August 2026
- Added to the register
- 13 August 2026
In 2026, a cyberattack on France's tax website exposed the data of about 678,000 taxpayers: identity, address and tax details. No passwords or bank details were stolen — but this can fuel very convincing scams posing as the tax office.
What leaked
-
Identity documents
It never changes, so it stays useful to a fraudster for life — and can open accounts or credit in your name.
-
Financial records
What you paid, to whom and when — enough to build a believable story about an account you hold.
-
Postal address
Used to stage a delivery, a utility visit or a neighbour that never happened.
What is not listed
- Passwords
- Bank details
- Card numbers
So there is no password to change here — the usual first move does not apply.
The record shows what was found in the data. Not listed is not the same as proven untouched.
Frequently asked questions
Was the French tax website hacked?
Yes. In 2026 a cyberattack on France's DGFiP exposed the identity, address and tax data of about 678,000 taxpayers; no passwords or bank details.
Source
A regulator investigated it, so both what happened and how far it went have been tested rather than asserted.
Regulatory office
CNIL
France's data protection authority. A company must notify it within 72 hours of a breach; it investigates and can fine.
See the source →Security professionals
4