Stolen details range from contact information to household finances and withholding rates
France's tax authority says attackers may have stolen the contents of messages exchanged with hundreds of taxpayers during the data raid it confirmed last week.In an update published this week, the General Directorate of Public Finances (DGFiP) said lists of messages exchanged with the authority were exposed. For around 250 people, the compromised information also included the messages themselves.Slightly more than 350,000 individuals were affected. The other exposed data included tax identification numbers, marital status, email and postal addresses, and phone numbers.
Tax records also exposed details such as household composition, number of dependents, family quotient, reference tax income, and withholding rates.
Beyond the personal and tax information, DGFiP said the other affected datasets contained information that was already publicly available.For approximately 250,000 businesses and professionals, the affected data was limited to company names and SIREN numbers, the unique nine-digit identifiers assigned to French businesses.The compromised cadastral data was limited to property addresses and dimensions, which DGFiP said were already publicly available.DGFiP said it was notifying affected taxpayers by email or post this week.DGFiP's latest FAQ pegs the total number of affected parties at roughly 600,000. That appears lower than the 678,000 "individuals and professionals" DGFiP said were affected last week, shortly after the alleged cybercriminal behind the attack, "ZeroBytes," claimed to have stolen data belonging to more than 2 million. The authority did not explain the discrepancy.The notifications warn that criminals could use the stolen details to make phishing attempts appear more convincing.
