French Tax Agency (DGFiP) Breach Exposes 678,000 Taxpayers — Defending Against Credential-Based Data Theft in Government Portals

France's tax administration, the Direction générale des Finances publiques (DGFiP), has confirmed that a sophisticated cyberattack exposed the personal data of approximately 678,000 individuals and businesses. The stolen data reportedly includes names, addresses, income figures, and tax details — precisely the dataset criminals need to commit large-scale identity theft, tax refund fraud, and hyper-targeted phishing against French citizens. A threat actor publicly claimed responsibility for the breach in late June, and French authorities have opened a criminal investigation led by the national cybercrime unit.

Based on available reporting, this was not a smash-and-grab ransomware event. Early indicators point to the abuse of legitimate access — a compromised or misused authorized account used to query taxpayer records at scale through the agency's consultation systems. That pattern should alarm every defender reading this, because it is the hardest class of breach to prevent with perimeter tooling: the attacker logs in rather than breaks in.

Whether you defend a government agency, a financial institution, a healthcare network, or any organization holding bulk citizen or customer records, this incident is your tabletop exercise made real. This post breaks down the attack pattern, what your SOC should be hunting for right now, and the concrete hardening steps that would have blunted this breach.

Technical Analysis

What We Know

• Victim: DGFiP (Direction générale des Finances publiques), France's public finance directorate
• Impact: Personal and financial data of ~678,000 taxpayers — individuals and businesses — including income and tax details
• Timeline: Threat actor claimed the breach in late June; DGFiP subsequently confirmed the exposure and filed a criminal complaint
• Investigation: Handled by France's national cybercrime unit
• Suspected vector: Unauthorized access through legitimate consultation channels — consistent with compromised credentials or abuse of an authorized third-party account rather than exploitation of a software vulnerability

No CVE has been associated with this incident, and we will not speculate one into existence. The defensive lesson here is not about patching — it is about identity, access governance, and behavioral detection on bulk data access.

The Attack Pattern: Living Inside Legitimate Access

Incidents of this type follow a well-documented chain mapped to MITRE ATT&CK:

1. Initial Access (T1078 – Valid Accounts): The actor obtains working credentials — via phishing, credential stuffing against a reused password, infostealer logs purchased on criminal marketplaces, or compromise of a partner organization whose users hold portal access.
2. Discovery (T1087 / T1213): The actor maps what the compromised account can reach: taxpayer lookup modules, batch consultation functions, export features.
3. Collection (T1213.002 / T1530): Systematic querying of individual records — often at low-and-slow rates to stay under naive alerting thresholds — or abuse of bulk-export functionality intended for legitimate administrative use.
4. Exfiltration (T1567): Data staged as query results, report exports, or scraped API responses leaves the environment through the same web session the legitimate application provides.

The critical defensive insight: every step after initial access generates telemetry that looks almost identical to a legitimate user's workday. The only reliable discriminators are behavioral — volume, velocity, scope, geography, and time-of-day anomalies measured against a per-user baseline.

Why This Matters Beyond France

Tax data is among the highest-value datasets a criminal can hold. It enables:

• Refund fraud filed under real identities with accurate income figures
• Financial phishing with correct tax references that defeats user suspicion
• Credit fraud and KYC bypass at financial institutions that accept tax documents as identity proof
• Resale to nation-state actors building targeting dossiers on citizens of interest

Any organization operating a portal where authenticated users can query citizen, patient, or customer records one-by-one at scale is exposed to exactly this attack. That includes tax authorities, licensing bodies, insurers, hospital portals, and benefits systems.

Exploitation Status

The stolen dataset is confirmed exposed and the breach is the subject of an active criminal investigation. There is no indication of a software vulnerability under active exploitation — the tradecraft itself (valid account abuse against record consultation systems) is the ongoing threat, and it is ubiquitous across government and financial portals worldwide.

Detection & Response

The detections below target the observable behaviors this class of attack produces: credential theft on application infrastructure, bulk querying of record endpoints, and anomalous session characteristics. Tune thresholds against your own baselines before deploying at production severity.

Sigma Rules

---
title: LSASS Memory Dump via comsvcs.dll on Application or Database Server
id: 9c2e4a71-3f68-4b1d-a527-8d6f0e2b5c94
status: experimental
description: Detects credential dumping using the built-in comsvcs.dll MiniDump technique against lsass.exe on servers hosting citizen/customer record applications. Consistent with post-compromise credential harvesting preceding valid-account abuse of data portals.
references:
  - https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rundll32.exe'
      - '\rundll32.exe'.exe
  selection_cli:
    CommandLine|contains:
      - 'comsvcs.dll'
      - 'MiniDump'
  filter_admin_workstations:
    Computer|contains: 'WKSTN'
  condition: selection_img and selection_cli and not filter_admin_workstations
falsepositives:
  - Legitimate crash-dump collection by support staff (rare on servers; verify via change ticket)
level: high
---
title: High-Volume Sequential Queries to Citizen or Taxpayer Record Endpoints
id: 4b7d1f06-8e3a-4c52-b9d1-2f6a0c7e5d38
status: experimental
description: Detects web requests to record-consultation endpoints with sequential or enumerated identifiers in the query string, indicative of scripted scraping of taxpayer/citizen records through an authenticated session. Deploy against reverse-proxy, WAF, or application access logs.
references:
  - https://attack.mitre.org/techniques/T1213/
  - https://attack.mitre.org/techniques/T1530/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1213
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/consultation'
      - '/dossier'
      - '/taxpayer'
      - '/record'
      - '/api/v1/citizen'
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  condition: selection_uri and selection_method
falsepositives:
  - Legitimate caseworker lookups (pair with per-user rate aggregation in the SIEM; a single request match is not an alert, sustained volume is)
level: medium
---
title: Mass Export or Report Generation Artifacts on Application Servers
id: 1f9a6c35-7d24-4e08-b3f6-5a1c8e90d274
status: experimental
description: Detects creation of large CSV/Excel/PDF export artifacts in application temp or export directories on servers hosting record portals, a common staging step in bulk data theft via abused legitimate accounts.
references:
  - https://attack.mitre.org/techniques/T1530/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1530
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\export\'
      - '\exports\'
      - '\tmp\'
      - '\temp\'
      - '\reports\'
  selection_ext:
    TargetFilename|endswith:
      - '.csv'
      - '.xlsx'
      - '.zip'
      - '.pdf'
  filter_app_svc:
    Image|endswith:
      - '\w3wp.exe'
      - '\java.exe'
      - '\tomcat.exe'
  condition: selection_path and selection_ext and not filter_app_svc
falsepositives:
  - Scheduled reporting jobs and legitimate batch exports (baseline scheduled task account and hours)
level: medium

KQL — Microsoft Sentinel / Defender

This hunt identifies authenticated users whose record-access volume or session characteristics deviate sharply from their own baseline — the single most reliable signal in valid-account data theft. It assumes application access logs are ingested into Sentinel (via CommonSecurityLog from a WAF/reverse proxy, or a custom table). The second section catches impossible-travel and off-hours sessions on privileged portal accounts via Entra ID sign-in data.

// Hunt 1: Users with anomalous bulk access to record-consultation endpoints
// Baseline each user's daily request volume and flag days > 5x their 30-day average
let lookback = 30d;
let window = 1d;
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where RequestURL has_any ("/consultation", "/dossier", "/record", "/api/v1/citizen")
| summarize DailyHits = count() by SourceUserID, Day = startofday(TimeGenerated)
| summarize AvgDaily = avg(DailyHits), MaxDaily = max(DailyHits) by SourceUserID
| where MaxDaily > 500 and MaxDaily > AvgDaily * 5
| project SourceUserID, AvgDaily = round(AvgDaily, 1), MaxDaily, Deviation = round(MaxDaily / AvgDaily, 1)
| sort by Deviation desc;

// Hunt 2: Off-hours or geo-anomalous interactive sign-ins on accounts with portal access
SigninLogs
| where TimeGenerated > ago(14d)
| where ResultType == 0
| where AppDisplayName has_any ("tax", "portal", "consultation")
| extend HourUTC = datetime_part("hour", TimeGenerated)
| where HourUTC < 6 or HourUTC > 22
| summarize Sessions = count(), Locations = make_set(Location), IPs = make_set(IPAddress)
    by UserPrincipalName, bin(TimeGenerated, 1d)
| where array_length(IPs) > 2 or Sessions > 50
| sort by Sessions desc;

// Hunt 3: Single session pulling many distinct record identifiers (scraping pattern)
// Requires a custom app log table with SessionId and RecordId fields
AppAccess_CL
| where TimeGenerated > ago(7d)
| summarize DistinctRecords = dcount(RecordId_s), Requests = count()
    by SessionId_g, UserId_s, src_ip_s, bin(TimeGenerated, 1h)
| where DistinctRecords > 200
| project TimeGenerated, UserId_s, src_ip_s, SessionId_g, DistinctRecords, Requests
| sort by DistinctRecords desc;

Velociraptor VQL

If IR confirms unauthorized access originated from an endpoint or jump host used to reach the portal, hunt the fleet for credential-theft artifacts and staged export files on systems that host or administer the application.

-- Hunt for credential-dump artifacts and staged data exports on application/adjacent servers
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(comsvcs.*minidump|procdump.*lsass|sekurlsa|nanodump)'
   OR Exe =~ '(?i)(mimikatz|procdump|pypykatz|nanodump)'

-- Locate large export-style files staged in non-standard locations (last 14 days)
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs=['C:/Users/*/Downloads/*.csv', 'C:/Users/*/Downloads/*.zip',
                 'C:/Temp/*.xlsx', 'C:/Temp/*.csv', 'C:/Windows/Temp/*.zip'],
          accessor='ntfs')
WHERE Size > 10000000
  AND Mtime > (now() - 1209600)
ORDER BY Size DESC

-- Identify outbound sessions from servers to rare external destinations
SELECT Pid, Name, Path, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Status =~ 'ESTAB'
  AND RemotePort in (443, 8443)
  AND RemoteAddress !~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)'

Remediation & Hardening Script

This PowerShell script audits the control failures that make this class of breach possible: accounts with privileged portal access lacking MFA, stale service accounts, and audit policy gaps on application servers. Run it against your identity infrastructure and portal host.

#Requires -RunAsAdministrator
# DGFiP-pattern breach readiness audit: identity + audit posture for record portals
# 1. Find enabled accounts with privileged group membership and old passwords
Get-ADGroupMember -Identity "Domain Admins" -Recursive -ErrorAction SilentlyContinue |
  ForEach-Object { Get-ADUser $_.SamAccountName -Properties PasswordLastSet, LastLogonDate } |
  Where-Object { $_.Enabled -and ($_.PasswordLastSet -lt (Get-Date).AddDays(-180)) } |
  Select-Object SamAccountName, PasswordLastSet, LastLogonDate |
  Format-Table -AutoSize

# 2. Enumerate service accounts that have logged on interactively (red flag)
$cutoff = (Get-Date).AddDays(-30)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$cutoff} -MaxEvents 5000 |
  Where-Object { $_.Message -match 'Logon Type:\s+(2|10)' -and $_.Message -match 'svc_|service_' } |
  Select-Object TimeCreated, Message | Format-List

# 3. Verify detailed audit policy is enabled on the portal host (process + file access)
auditpol /get /category:"Detailed Tracking"
auditpol /get /category:"Object Access"

# 4. Enable process command-line auditing if missing (critical for Sigma rule fidelity)
$reg = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit'
if (-not (Test-Path $reg)) { New-Item -Path $reg -Force | Out-Null }
Set-ItemProperty -Path $reg -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1 -Type DWord
Write-Output '[+] Process command-line inclusion in audit events enabled.'

# 5. Baseline export: all users with access to the record application group
Get-ADGroupMember -Identity "GG-Portal-Consultation-Users" -Recursive |
  Select-Object Name, SamAccountName, objectClass |
  Export-Csv -Path ".\PortalAccess_Baseline_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Output '[+] Access baseline exported. Diff this weekly against production membership.'

Remediation

There is no patch for this breach — the remediation is architectural and procedural. Prioritize the following, in order of impact:

Immediate (24–72 hours)

1. Force password resets and revoke active sessions for every account with access to record-consultation modules. If a threat actor holds valid credentials, every hour of delay is more records lost.
2. Enforce phishing-resistant MFA (FIDO2/passkeys) on all portal accounts, with priority on partner and third-party accounts — the most commonly abused vector in government breaches of this type.
3. Enable or verify per-user query-rate alerting on the application. Any single account touching more than a defined threshold of unique citizen records per hour or day should trigger automatic session termination and SOC review.
4. Review third-party and inter-agency access grants. Enumerate every external organization whose users can query your records; suspend anything that cannot be justified and re-credentialed.

Short term (2–4 weeks)

5. Implement behavioral baselining per user and per role (the KQL hunts above are a starting point). A caseworker querying 40 records a day is normal; 4,000 is an incident.
6. Restrict bulk-export functionality to named roles with dual-control approval (four-eyes principle) for any export above a defined record count.
7. Deploy step-up authentication for sensitive queries — re-authentication required before viewing full income/tax records, even within an authenticated session.
8. Geo-fence and time-bound portal access where operationally feasible; partner accounts should not authenticate at 03:00 from unfamiliar ASNs.

Strategic (30–90 days)

9. Adopt data-centric access controls: tokenize or mask high-sensitivity fields (income figures, tax IDs) by default, revealing them only on justified, logged, per-record requests.
10. Run a purple-team exercise replaying this exact scenario — valid account, low-and-slow scraping, bulk export — and measure time-to-detect. If your SOC cannot catch it in the exercise, it cannot catch it in production.
11. Align with CIS Control 8 (Audit Log Management) and Control 6 (Access Control Management), and ensure application-layer access logs — not just authentication logs — flow to your SIEM. Authentication logs alone would have shown nothing wrong in this breach.

For affected French taxpayers: DGFiP and French authorities will communicate through official channels. Expect a wave of phishing impersonating the tax agency citing the breach — legitimate DGFiP communications will never request credentials or payment details by email or SMS.

The Bottom Line

The DGFiP breach is a case study in the threat that keeps CISOs of record-holding institutions awake: not zero-days, but legitimate access used illegitimately. Perimeter defenses, patch cadences, and EDR all have their place — none of them stop an attacker who simply logs in and starts querying. The organizations that fare best against this pattern are the ones that instrument what their users do with data, not just how they get in. If your monitoring cannot answer "how many citizen records did this account touch yesterday, and is that normal for them?" — that is the gap this breach should drive you to close this quarter.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub