French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks

An attacker used stolen passwords of staff at France's tax administration to take tax data on hundreds of thousands of taxpayers and businesses in June and July. Neither the tax administration nor France's national cybersecurity agency saw the data leave. The attack was not sophisticated, the agency, ANSSI, says in a report (in French) published on Tuesday: it worked because of weak

Reported facts: Attackers used stolen staff credentials to access and exfiltrate tax data affecting more than 350,000 individuals and 250,000 businesses, with the activity remaining undetected for approximately seven weeks. ANSSI attributed the exposure to weak login protection, insufficient network separation, and monitoring gaps rather than a sophisticated attack. RealGround analysis: The incident is directly relevant to data leakage and highlights the need for security-readiness reviews covering identity controls, network segmentation, data-loss monitoring, detection coverage, and incident governance for AI-enabled systems handling sensitive data.