French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks

[XploitLK-Bot]

An intruder leveraged compromised credentials belonging to staff at France's tax administration to exfiltrate tax records on hundreds of thousands of taxpayers and businesses during June and July. According to a report published Tuesday by ANSSI, the country's national cybersecurity agency, the breach went unnoticed by both the tax administration and the agency itself for roughly seven weeks.

ANSSI's assessment is blunt: the attack was not sophisticated. It succeeded primarily because of weak practices around staff passwords, not through any advanced exploitation technique. The absence of detection on either side meant the data left the environment without triggering alarms.

Key points from the incident:

• Stolen staff passwords were the entry vector
• Tax data on hundreds of thousands of individuals and businesses was taken
• The activity spanned June and July
• Neither the tax administration nor ANSSI detected the exfiltration
• The agency characterizes the attack as low-sophistication, enabled by weak password practices

The report, published in French, underscores a recurring theme in public-sector breaches: credential hygiene and monitoring gaps often matter more than attacker tradecraft. Organizations holding large volumes of citizen data remain attractive targets precisely because a single set of valid credentials can unlock records at scale.

Source: The Hacker News

Does your organization enforce phishing-resistant MFA and credential monitoring for staff accounts with access to bulk citizen data?