DGFiP Cyberattack: The Response Plan That Struggles to Convince

Following the sequence of apologies from Public Accounts Minister David Amiel to the 678,000 individuals and professionals whose tax data were stolen, a government response was needed to address this “technical debt” with “human and financial resources”.

After an interministerial crisis cell convened by the Prime Minister on August 17, a series of measures intended to plug the breaches in Bercy’s information system were announced in the wake of the event.

First totem of the government’s response: the generalization of two‑factor authentication for all agents of the DGFiP, promised by the end of the year. But Bercy itself acknowledges: several accounts already protected by this mechanism could have been compromised during the latest incidents. The two factors, indispensable as it may be, do not do everything: you still must monitor what happens after logging in.

That is the second axis of the plan: strengthen detection mechanisms to improve the identification of account takeovers and suspicious behaviors. Moreover, access quotas, already applied to certain files such as FICOBA, should be rolled out more broadly. As if under a “zero trust” banner…

Authenticate, educate, detect

The third pillar, more human: intensification of bug bounty campaigns and strengthening training. Also mentioned is a renewed reliance on AI to simulate attacks and detect vulnerabilities before they can be exploited.

A minimum service in cyberspace, one might say…

All the more so given that the surge in massive breaches affecting state services’ databases is well documented.

In a report published in January 2025, the CNIL noted 5,629 personal data breaches in 2024, a 20% rise year over year, with the number of incidents affecting more than a million people doubling in twelve months.
The report described, scene by scene, the five‑act modus operandi that would replay itself at the DGFiP: obtaining legitimate login data, gaining access to the information system, massive data exploration due to overly broad authorizations, large‑scale extraction because of insufficient detection indicators, then sale of the data without the organization realizing it.

The institution recommended, in black and white, multi‑factor authentication, staff awareness, a policy of restricted authorizations, and real‑time analysis of login logs…In short, almost word for word, the measures that Bercy announces today in a state of emergency.

The question that arises is the delay between the diagnosis and the implementation.

Solidaires Finances Publiques: “communicating isn’t securing”

In a press release published the same day as the crisis cell, the Solidaires Finances Publiques union denounces announcements deemed far below the stakes. The union questions the fate of the first €200 million envelope, already promised in April after the ANTS data breach.

One sum whose use remains, to date, largely unclear.

On substance, the union ties the fiscal administration’s vulnerability to budget choices made for years. The ongoing shrinkage of human and technical resources would have directly weakened the DGFiP’s defensive capacities.

As for the intrusion tests recommended to identify internal vulnerabilities, the union considers the announcement all the more surprising given that they should already be standard in a tax administration’s information system and have long been recommended by the ANSSI.

The plan presented by Bercy faces a double skepticism. If technically, as seen, the measures check the right boxes, their credibility will depend on rapid deployment and on the traceability of budgets promised since the ANTS affair.

Massive data theft: eight years of intrusions in state services