Cybersecurity
French tax data theft goes undetected for seven weeks
ANSSI said stolen staff passwords let an attacker copy tax and land-registry data from French government systems for weeks, before the theft was identified after a forum post on 12 August.
- ANSSI said an attacker used stolen DGFIP staff passwords to reach tax data through E-Contact in June and July.
- The DGFIP said the exposed data covered just over 350,000 individuals and just over 250,000 businesses, and it said taxpayers' own accounts were not compromised.
- ANSSI said the theft was not identified until 12 August, when the attacker claimed it on an online forum.
- After that claim, Prime Minister Sébastien Lecornu asked ANSSI for an in-depth audit.
ANSSI said the attacker first used stolen DGFIP staff passwords to reach E-Contact through PIGP and ADER. The agency said weak login controls, poor separation between networks and gaps in monitoring allowed the intrusion.
The DGFIP said the exposed material covered just over 350,000 individuals and just over 250,000 businesses. It said some message contents were also taken for smaller numbers of people and firms, while taxpayers' own accounts and passwords were not compromised.
According to ANSSI, the security operations centre reset passwords when alerts appeared, but it did not stop active sessions or monitor ADER. The agency said no one linked the warnings together, including night-time logins, VPN use, suspicious addresses and a large volume of requests.
ANSSI said a second route involved APEX and land-registry data, with a possible compromise of a surveyor's computer at a private firm. The theft was identified only after the attacker claimed it online on 12 August, and the DGFIP later shut staff out of ADER and PIGP while it drew up further monitoring and authentication changes.
Named in this story
People
- Sébastien Lecornu
- Prime minister who asked ANSSI for an in-depth audit
Organisations
- Senate finance committee
- Issued a note estimating the households affected by the land-registry theft
Governments and agencies
- Direction générale des Finances publiques (DGFIP)
- France's tax administration and the owner of the affected systems
- Agence nationale de la sécurité des systèmes d'information (ANSSI)
- Investigated the intrusion and published the report
- Education ministry
- Its connected systems were used to reach the state network and it alerted other ministries
Products and systems
- E-Contact
- Messaging tool from which data was taken
- impots.gouv.fr
- Tax website run by the DGFIP
- PIGP
- DGFIP portal used for email and human resources services
- ADER
- Portal that gave access to some DGFIP applications through the government network
- Réseau Interministériel de l'État (RIE)
- Network connecting French government ministries
- APEX
- Portal used by partners such as notaries and land surveyors
How the source tells it
The article was a restrained investigative report with little overt emotive framing.
No emotive framing was found in the original.