Cybersecurity

France's Tax Agency Is Exempt From Its Own GDPR Fines

DGFiP took 48 days to disclose a breach of 678,000 tax records. French law explicitly exempts the state from the GDPR fines it would impose on a private company.

CybersecurityBy Servola Tech Desk2026-08-174 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

France's Tax Agency Is Exempt From Its Own GDPR Fines

Key takeaways

A hacker broke into DGFiP, France's tax authority, on June 26, 2026 using stolen credentials from an employee and an authorized third party, extracting data on 678,000 individuals and businesses - and the breach only became public on August 12, when the attacker posted the claim himself, 48 days after the state cut off his access.
France's Ministry of Finance confirmed the intrusion on August 13 and said DGFiP would notify the CNIL and file a criminal complaint, but under the law that implements GDPR in France, administrative fines of up to 10 million euros or 2 percent of global revenue explicitly exclude 'treatments implemented by the State' - the exact penalty that forces private companies to disclose fast does not apply to the agency that just took 48 days.
For any business whose SIREN number and registered address DGFiP now holds exposed, the practical lesson is that a government counterparty's breach-disclosure timeline runs on political pressure, not financial deterrence, and a business owner needs their own monitoring rather than an assumption that a state agency will self-report on the same clock private vendors do.

What DGFiP actually lost

The intrusion into France's Direction Generale des Finances Publiques began on June 26, 2026, when an attacker used stolen credentials belonging to a DGFiP employee and a separate authorized third party to access the agency's systems. Internal controls cut off that access before the end of June, and the Ministry of Finance's official communique states the exposed data covers roughly 678,000 individuals and businesses - close to the 678,438 lines the attacker himself later claimed. For individual taxpayers, the exposed fields are full names, family quotient classification, reference taxable income and withholding tax rate; for businesses, the SIREN registration number, business address and the address of the authorized representative.

DGFiP has stated that no secure taxpayer accounts on the impots.gouv.fr portal were compromised, so the data does not by itself grant access to anyone's live tax filings. But the agency itself described the intrusion as more sophisticated than anything it had previously faced, and the exposed fields - income level, tax rate, family situation, business registration and address data - are precisely the kind of detail that makes a follow-up phishing call or fraudulent email convincing.

Forty-eight days from cutoff to public disclosure

The timeline that matters here is not the intrusion itself but the silence afterward. DGFiP cut off the attacker's access at the end of June, and the breach stayed unannounced until August 12, when the attacker posted his own claim of the data theft. Only the following day, August 13, did the Ministry of Finance issue an official communique confirming the intrusion, stating that DGFiP would notify the CNIL, France's data protection authority, and file a criminal complaint with the Paris prosecutor's office, which has since opened an investigation involving OFAC, the national cybercrime unit.

That 48-day gap is legal under the letter of GDPR: the regulation's 72-hour clock applies only to notifying the supervisory authority, not to notifying the individuals affected, who are owed disclosure only 'without undue delay' when a breach presents a high risk - a standard with no fixed number attached. Public Accounts Minister David Amiel has since asked DGFiP to notify the affected taxpayers directly and to propose reinforced security procedures, but that request came after the attacker's own post forced the agency's hand, not before it.

The fine that does not apply to the fine-payer

Here is the asymmetry a private-sector operator should sit with: under the French law that implements GDPR, a company that handled a breach the way DGFiP did - compromised third-party credentials, weeks of silence, disclosure only after the attacker went public - could face CNIL fines of up to 10 million euros or 2 percent of global annual revenue for failing to notify affected individuals without undue delay. The same legislation explicitly excludes 'treatments implemented by the State' from those administrative penalties. The mechanism that is supposed to make fast disclosure a matter of financial self-interest for every company DGFiP regulates simply does not exist for DGFiP itself.

A public-sector union raised exactly this question once the breach became public: without the attacker's own disclosure, when and how would affected taxpayers and businesses ever have learned what happened. That is not a hypothetical for the roughly 678,000 people and companies now holding a piece of information they did not have two months ago - and it is a direct governance lesson for any owner who assumes a government counterparty's data-handling incentives mirror the ones regulation imposes on their own company. They do not, and the gap only closes when the attacker decides to talk. Any business whose SIREN and registered address sat inside this exposure should treat the coming weeks as a live impersonation-fraud window, not a closed incident, regardless of how long DGFiP itself took to say so.

Frequently asked questions

What data was exposed in the DGFiP breach?

For roughly 678,000 affected individuals, the exposed data includes full names, family quotient classification, reference taxable income and withholding tax rate. For businesses, it includes the SIREN registration number, business address and the address of the authorized representative. DGFiP says no secure taxpayer accounts on impots.gouv.fr were compromised.

How long did it take France to disclose the breach?

The attacker's access was cut off at the end of June 2026, but the breach was not publicly disclosed until August 12, when the attacker himself posted the claim, followed by an official Ministry of Finance confirmation on August 13 - a gap of roughly 48 days between cutoff and public disclosure.

Can the French state be fined under GDPR the way a private company would be?

No. The French law implementing GDPR sets administrative fines of up to 10 million euros or 2 percent of global revenue for failures like delayed breach notification, but it explicitly excludes 'treatments implemented by the State' from those penalties, so DGFiP faces no equivalent financial consequence for the disclosure delay.

DGFiP disclosed this breach only after the attacker did - the regulation that would have fined a private company into moving faster does not apply to the state agency that just proved why that incentive matters.

DGFiPFranceGDPRData BreachCNILPublic Sector Security

Airbus's Sovereignty Deal Keeps Skywise on AWS

On July 16, Airbus picked Scaleway as its sovereign cloud provider after scoring bids on protection from foreign extraterritorial law - yet Skywise, its own flagship aviation data platform, stays on AWS, the exact cloud the tender says needs shielding from.

3 min read

Cybersecurity

A Police Dashboard on 700 Foreigners Sat Open

A police surveillance dashboard in Zhangjiakou held profiles on more than 700 foreign residents and 300 foreign journalists, and it was left unsecured. The vendor patent behind it is the part that should change how you brief staff travelling to China.

4 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.