A report from the Senate Finance Committee reveals the modus operandi used in the cyberattacks targeting the Directorate General of Public Finances during the summer. By moving between different administrative systems using previously compromised credentials, the hackers were able to access the personal information of nearly 350,000 individuals and 250,000 professionals.
During an initial intrusion carried out between June and July, the attacker reportedly used the account of a National Education employee to access the state's interministerial network. He then allegedly exploited login credentials belonging to tax officials, likely obtained through password-stealing software, to access the "e-contact" application and extract data.
Multiple flaws in the systems of Bercy
A second attack was conducted between July 27 and August 8 using the compromised account of a land surveyor. It allowed access to the cadastral data of 434,564 households. A third intrusion, detected on August 17, reportedly exploited a technical vulnerability in a statistical tool used to process information on unclaimed estates.
Senators denounced "structural weaknesses" in access security and the detection of abnormal behavior. The French tax authority (DGFiP) has since closed certain access points, banned the use of personal computers, and announced the expansion of two-factor authentication. Systems capable of detecting mass browsing are also to be deployed more quickly. The investigation is ongoing, and an 18-year-old suspect has been formally charged.
