French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks

A data breach at France's tax administration occurred in June and July, where an attacker used stolen staff passwords to steal tax data of hundreds of thousands of taxpayers and businesses. The breach went undetected for seven weeks, with neither the tax administration nor the national cybersecurity agency noticing the data exfiltration. According to the national cybersecurity agency, ANSSI, the attack was not sophisticated and succeeded due to weak security measures. The agency published a report on the incident, detailing the circumstances surrounding the breach. The stolen passwords were the key factor that allowed the attacker to access the sensitive tax data. The simplicity of the attack was a major factor in its success.