ÊTRE CYBER
etrecyber.frby Christophe Mazzola
FR
What just happened

The French tax office breach: your income next to your address

In late June, 678,438 tax records left the French Directorate General of Public Finances. The public found out on 13 August, the day after they went on sale. This data is not used to empty your account: it is used to make a message believable. Here are those messages, and how to spot them.

The essentials, in four points

  1. An attacker obtained the credentials of an authorised officer, came in through the VPN, and queried records with the internal tool built for that. No exotic flaw: he walked through the door with someone else’s keys.
  2. 678,438 rows extracted, just under 393,000 of them private individuals. Each record holds birth name, date and place of birth, address, household composition, family quotient, reference tax income and withholding rate.
  3. Seven weeks separate the intrusion from the public being told. For seven weeks, the people concerned lived with their data in the wild without knowing they should be on guard.
  4. Four months earlier, in February, the same administration lost 1.2 million records from FICOBA, the national bank-account registry, through the same kind of vector.

Why the income figure changes everything

A list of addresses is for sending in bulk and hoping a handful of people click. A list sorted by declared income to the euro is for choosing who to go and see. They are not the same weapon.

The file holds more than 26,000 declarations above 100,000 euros and a few hundred above a million, with the address alongside. At the other end, a high family quotient marks a large household and a low income marks someone eligible for benefits. Either way, the sorting is already done.

This data does not expire

An address changes, an income moves, a password is replaced in thirty seconds. A birth name and a place of birth follow you to the end. That is the difference between this breach and a leaked password: there is nothing to change.

What remains possible, and what this page is about, is recognising the messages built from it. They are coming, and they will be good.

How do I know if I am affected

Individual notification is under way through official channels. That is exactly what gives the fakes perfect cover: while the real notice circulates, the fake one passes for it.

No site will tell you whether your data is in this breach. The ones offering to are collecting your information, or worse. When in doubt you do not click: you go to impots.gouv.fr yourself, by typing the address, and you check your secure mailbox there.

The seven messages coming your way

None will ask for your password. They will ask you to act fast, on a channel they picked. That is the one thing they share, and it is how you catch them.

  1. The fake breach notificationAn email or text telling you that you are affected, with a link to check. The most immediate, and the best covered, since the real notice is going out at the same time.
  2. The fake refundA message quoting your exact reference tax income and withholding rate, announcing an overpayment. You check it against your tax notice, the figures match, you enter your bank details.
  3. The fake tax officerOn the phone, with your family situation, your address and your income. Urgent correction, calculation error, audit under way. The goal: an immediate transfer, or a code received by text.
  4. The fake bank adviserThe costliest fraud in France, and the breach gives it what it lacked. Someone who knows your declared income and your household passes the credibility test in ten seconds.
  5. Administrative identity theftThe file holds exactly the fields asked for when opening an account or a loan. You will find out when a payment is missed, months later.
  6. Mobile line takeoverBirth name and place of birth are the answers to most carriers’ security questions. A hijacked line means your one-time codes land with someone else.
  7. Cross-referencing with earlier breachesFree, SFR, Bouygues, the ANTS, France Travail, sports federations. Aggregate them: identity, address, phone, email, ID number, employer, and now income. The dossier is nearly complete.

One rule defuses all seven: never act on an incoming contact. Hang up, close the message, and call back yourself, using the number on your tax notice or the back of your bank card. A genuine service will never hold it against you.

What you can do tonight

None of this repairs the breach, and nothing will. These four moves do cut off almost everything that can be done with it against you. Give it half an hour.

  1. Warn the people around you, older parents firstThe fake tax officer on the phone works on people who were not warned. A call from you beats every technical protection.
  2. Call your carrier and ask to lock number portingThat is what stops someone taking over your number, and therefore your text codes, armed with your birth name and place of birth.
  3. Move your important accounts to an authenticator appA code by text depends on your mobile line. An app depends on your phone. Bank, mailbox, tax account.
  4. Watch what gets opened in your nameIn France you can exercise your right of access with the Banque de France to find out whether a loan was taken out with your identity. It is free.

If it already happened

The cards to follow, in order
I got a text about a parcel, a tax refund or a benefitThe classic one. Let’s read it together, line by line.My computer is showing an alarming warningFake tech support, frozen screen, a number to call.My bank card has been chargedWhat to do within the hour, and what the law guarantees you.Someone is impersonating meFake profile, messages to your circle, cloned voice.

The rest of the book is here, free

This breach is not an isolated accident, it is the normal state of things. I wrote a book to make that manageable without being a specialist, and this site gives away all of its content: the 224-step roadmap, the screen-by-screen settings cards, the tools. No account, no email to hand over, nothing leaving your device.

Start the roadmapThe right settings

The full analysis

This page covers the facts. The whole file, sourced, including what the seven-week timeline reveals, is on my blog (in French).
DGFiP: they knew in late June, you found out on 13 Augustchristophemazzola.fr