ANSSI report finds stolen passwords and weak MFA enabled DGFiP breach

September 29, 2026 at 09:25 PM1 min

This digest was compiled by AI from multiple sources — links to the originals are below.

France's ANSSI cybersecurity agency published a report on September 29, 2026 detailing the August 2026 breach of the DGFiP tax authority. The report attributes the breach to stolen credentials and insufficient multi-factor authentication, exposing data of hundreds of thousands of French citizens. The agency also found that the data exfiltration went undetected despite multiple warning signals.

Key Facts

The ANSSI report was published on September 29, 2026.
The breach exposed data of nearly 353,000 individuals and 252,000 professionals from the E-Contact service.
The attacker used credentials stolen by infostealers from DGFiP agents and external users.
The APEX portal used email-based second factor, which was bypassed by compromising a surveyor's workstation.
The ADER portal used for data extraction was not monitored by the DGFiP SOC.

Breach Overview

In August 2026, the Zerobytes group claimed responsibility for stealing data from DGFiP services. One dataset came from E-Contact, a messaging tool for user interactions, and another from cadastral data accessed via a surveyor firm's account. The compromise occurred in June and July 2026, exposing data of hundreds of thousands of French citizens.

Security Failures

The ANSSI found that the attack did not rely on a complex technical flaw but on a succession of insufficient protections. Many DGFiP services lacked multi-factor authentication or had weak implementations. The APEX portal used a code sent by email as a second factor, which was bypassed after compromising a surveyor's workstation.

Detection Gaps

The ADER portal, used to access E-Contact and extract data, was not supervised by the DGFiP's security operations center. The report highlights that multiple warning signals existed but were not corrected.