Tax fraud: Paris prosecutor's office opens investigation into 678,000 victims

The cyber section of the Paris prosecutor's office has opened an investigation following the cyberattack that hit the tax administration at the end of June, allowing hackers to steal the personal data of 678,000 users, both individuals and companies.

The investigation has been entrusted to the Office against cybercrime (Ofac). The prosecutor's office is targeting, in particular, the "fraudulent extraction of data contained in an automated personal data processing system implemented by the State," as well as "participation in a criminal association with a view to preparing an offense punishable by at least five years' imprisonment."

The attack, described as "more sophisticated" than those seen in the past, allowed for the extraction of sensitive data from taxpayers and businesses. For individuals, the stolen information includes names, family quotient, reference tax income, and withholding tax rate, explained Amélie Verdier, Director General of Public Finances. Businesses are exposed to data considered "less sensitive": their SIREN number, and the address of their registered office and authorized representative.

The tax authorities sought to reassure the public: the stolen data "does not allow access to the secure account on impots.gouv.fr." Affected users will be contacted early next week, particularly to warn them about the risks of identity theft.

This attack is part of a series of recent cyber incidents targeting French public bodies, including the National Agency for Secure Documents (ANTS) and INSEE. It reignites questions about the security of the State's information systems.

The Parisian justice system is facing a surge in cases of this type. In June, two suspected hackers, aged 22 and 15, were charged after the dismantling of the "Dumpsec" group, suspected of targeting the National Assembly, Leroy Merlin, several sports federations, and medical websites, amassing tens of millions of data points and targeting more than 1,500 entities. "These are young French hackers seeking notoriety and believing themselves to be untouchable," described Commissioner Julie Benoit, head of the cyber investigations unit at the French Anti-Corruption Office (OFAC), describing them as "completely uninhibited" and "often self-taught."

The young profile of the perpetrators appears regularly in these cases. At the end of January, two suspects were charged in connection with attacks against the academies of Réunion, Reims, and Clermont-Ferrand: the younger was 17, the older 20. At the beginning of 2026, a young adult born in 2007 was charged for his alleged involvement in hacking the French Shooting Federation, an attack that subsequently facilitated gun thefts in several regions of the country. In April, a 21-year-old suspect, operating under the alias "HexDex," was charged and imprisoned, linked to around a hundred reports of website hacks, including the Firearms Information System, which lists legal gun owners in France.