Filtration of tax data in France by stolen passwords and authentication failures in DGFIP

In June and July, an attacker extracted tax data from hundreds of thousands of taxpayers and companies from the courier system of the General Directorate of Public Finance (DGFIP), the agency that manages the portal impots.gouv.fr. According to the report of the national cybersecurity agency ANSSI and DGFIP communiqués, the intrusion did not exploit a zero-day vulnerability or advanced techniques: it was based on passwords of stolen employees, lack of strong authentication in some applications and segmentation and network monitoring failures.

Facts confirmed: the DGFIP and ANSSI detail that the records of E- Contact - the tool that taxpayers use to exchange messages with the administration - were consulted or copied for just over 350,000 people and about 250,000 companies. The types of data concerned include tax identifiers, addresses, family status, income reference, retention rate and the lists of messages exchanged; the actual content of the messages would have been seen for a smaller subset (less than 250 people and less than 2,076 companies, according to official figures). The records point to two different access routes: one that took advantage of internal template passwords to access portals such as PIPP and ADER, and another linked to APEX (external partner portal) that allowed for the availability of registration data.

How it worked technically (according to the investigation): researchers conclude that many employee passwords were probably removed by "infostealer" type malware on equipment that the DGFIP did not manage (probably personal or third-party devices). The portals used by the attacker requested only password - or password plus code by email - which facilitated access when the attacker controlled those credentials or the second factor mailbox. Once inside, the lack of separation between sensitive applications and the rest of the RIE network (the network that interconnects ministries) allowed side movements to E-Contact. In addition, automated scraping tools were used to copy pages one by one for long periods. A number of initial incidents were detected by the SOC, passwords were changed, but open sessions were not completed and signs were not correlated (early night, VPNs, suspicious IP addresses, abnormal volume of requests) to stop the extraction.

What failed in defense: ANSSI identifies three main problems: insufficient authentication in critical applications, poor separation of perimeters and privileges and incomplete monitoring. The ANSSI sensors were at the entry / exit points of the network, without access to application records, so the activity with legitimate credentials went unnoticed; the DGFIP SOC did not monitor ADER or cross indicators that, combined, would have pointed to massive scraping (e.g. number of requests for account, long sessions after password resplacements, previously marked IP connections).

The confirmed consequences have already had an operational impact: the DGFIP blocked staff access to some portals (PIPP, ADER) and APEX was temporarily closed for third parties, which led to interruptions in internal services and for partners. ANSSI has ordered a broader audit to identify additional vulnerabilities.

What it can involve for actual victims and risks: Although the taxpayers' personal accounts were not committed to login on impots.gouv.fr, the filtered information allows much more credible phishing attacks, targeted fraud and use of data for identity theft. Directions, tax numbers and income references are elements that facilitate scams and the circumvention of social security and bank controls. In addition, the exposure of conversations with the administration may reveal sensitive information about personal or property situations.

What is confirmed vs what is still uncertain: the approximate number of records consulted and the general vectors (stolen passwords, portals access) is confirmed. It is an estimate - not fully publicly verified - that the second track (APEX / cadastral registration) affected almost 435,000 households according to a parliamentary note cited in the press. It is not publicly confirmed whether the data removed have already been published or sold in forums, or the subsequent use of the information. There is also no complete public confirmation of the exact method of initial infection of the equipment that served to steal the passwords (although ANSSI qualifies the use of infostealers in unmanaged devices as "probable").

For citizens and companies affected or concerned by this leak, the concrete measures are clear and practical: check any official communication from impots.gouv.fr do not respond to unsolicited messages requesting personal data, and activate as far as possible additional verification mechanisms in their financial services. Change critical passwords if you have reused credentials between services and monitor bank extracts and fraud notifications. Report attempts to phishing the official channels of the DGFIP and, in the event of signs of subplanting, contact your bank and the competent authorities.

For IT and security managers, the technical recommendations are operational and prioritized: to implement solid multifactor authentication in all applications (to avoid the code sent by mail as the only second factor; to prefer physical tokens or authentication apps on separate devices), to apply immediate revocation of all active sessions when a password is re-established, to deploy monitoring at the application level in an IMS (collection and correlation of logs), to impose quotas and limits of access to records and requests to detect scraping and to segment networks to prevent lateral movement to sensitive services. Administrative access to corporate resources from unmanaged personal devices should also be prohibited and endpoint protection strengthened in all equipment that may contain credentials.

ANSSI and the DGFIP have published reports and warn that this episode illustrates how simple techniques combined with operating failures can lead to mass data leaks. For more information on protection measures and good practice guides in strong authentication, see the official ANSSI resources at ssi.gouv.fr and notices to the public on the site of the impots.gouv.fr. The central lesson: safety depends not only on patches or firewalls, but on basic controls applied constantly and the ability to correlate signals before a routine intrusion becomes a mass leak.