France's tax authority was targeted by a cyberattack that exposed sensitive data belonging to individuals and businesses, the Economy Ministry confirmed Thursday.
A malicious actor claimed to have gained unauthorized access to the information system of the Directorate General of Public Finances (DGFiP) in late June after stealing someone's identity, according to a ministry statement cited by BFMTV.
Initial investigations found that the breach allowed the attacker to view and extract data before the unauthorized access was blocked during an internal audit at the end of June.
The breach reportedly involved a compromised internal virtual private network, or VPN, through which the attacker accessed a taxpayer search tool.
Authorities are continuing their investigation to determine the precise nature of the compromised data and the number of people affected.
The incident could involve millions of users, according to the report.
Potentially exposed information includes names, birth details, postal addresses, phone numbers, email addresses, tax identification numbers, withholding tax rates and records of correspondence with tax officials. Business registration numbers may also have been compromised.
The ministry has not confirmed the full list of exposed data. No usernames or passwords were included in the breach, according to the report.
France's data protection authority, the CNIL, has been notified about the incident.
