ANSSI's assessment is blunt: the attack was not sophisticated. It succeeded primarily because of weak practices around staff passwords, not through any advanced exploitation technique. The absence of detection on either side meant the data left the environment without triggering alarms.

Key points from the incident:

• Stolen staff passwords were the entry vector
• Tax data on hundreds of thousands of individuals and businesses was taken
• The activity spanned June and July
• Neither the tax administration nor ANSSI detected the exfiltration
• The agency characterizes the attack as low-sophistication, enabled by weak password practices

The report, published in French, underscores a recurring theme in public-sector breaches: credential hygiene and monitoring gaps often matter more than attacker tradecraft. Organizations holding large volumes of citizen data remain attractive targets precisely because a single set of valid credentials can unlock records at scale.

Source: The Hacker News

Does your organization enforce phishing-resistant MFA and credential monitoring for staff accounts with access to bulk citizen data?