French tax authority admits data heist after crook touts 2M records
- ID
- 14229
- Status
- summarized
- Published
- 14 Aug 2026, 10:27 PM
- Fetched
- 14 Aug 2026, 11:28 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/14/french-tax-authority-admits-data-heist-after-crook-touts-2m-records/5287885
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 2.5
- Created
- 14 Aug 2026, 11:31 PM
- Tags
- Audience
- developersdatabase_learners
What happened
France's tax authority (DGFiP) confirmed an intruder extracted taxpayer data in June 2026 after a cybercriminal using the alias 'ZeroBytes' advertised a database of 2 million French taxpayers on a cybercrime forum, claiming access via stolen credentials and an MFA bypass. DGFiP disputes the attacker's claim of continued access, says the breach was severed at end of June during an audit, and is investigating the exact scope while notifying CNIL and affected users.
Why it matters
The breach vector—stolen credentials plus an MFA bypass—is a reminder that MFA alone is not sufficient if session tokens or bypass techniques are in play. Builders handling authentication should review whether their systems are vulnerable to token theft or MFA fatigue/bypass, but this incident has no direct operational impact on Malaysian builders.
Discussion angle
How stolen credentials plus MFA bypass works in practice and what mitigation patterns (session binding, conditional access, token revocation) actually help—using this incident as a case study rather than a call to action.