France's tax authority had data stolen on 680k taxpayers | Hacker News Reader

France's tax authority had data stolen on 680k taxpayers

korben.info

57 pointsrzk38 comments

I worked as a temp for france tax collection before my degree (circa 2012-2013l.

People were registered in 3 different database, each of them independent, each of them on a different software (one aspnet/vbnet you connected through a browser, one very, very old, clearly IBM software, and the third one was probably as old as IBM, if not older, but looked like a minitel portage on windows). All the relevant data were dispersed on those three (a fourth one existed but only authorised people could use it because you had bank account numbers on it). Also, only the Vbnet software allowed copy paste, which means that to find someone, you had to file the tax number+surname 3 time, without making any mistake.

I wonder which one was broken into. No bank details, so it probably was one I had access to as a temp. Maybe they upgraded their software though, because if I remember correctly only they all worked on the local network (not sure about the aspnet one).

> "The attack is not recent, however. It dates back to late June - the 26th, to be precise, according to the hacker - and the administration had detected and stopped it at the time, without ever saying a word publicly."

I thought GDPR mandated disclosure of data breaches involving PII. Is France's tax authority somehow exempt?

edit to add: Article 33 particularly,

https://gdpr.eu/article-33-notification-of-a-personal-data-b...

Rules for thee not for me.

In the article I read about this it appears that they only found out now. They apparently launched an investigation and discovered the breach after being contacted by the hacker

Now you are realizing that some "rules" don't apply to others.

Well it certainly lends credence to the opinion that GDPR and similar regulations are mostly designed for EU revenue generation by extracting fines from American tech companies. The actual privacy protections are secondary.

Having worked in multiple EU companies that went to great effort to comply with GDPR and also had legitimate issues that needed to be resolved under threat of real fines, this is just an incorrect take.

That'll be the GDPR that protects my privacy and fines people that fuck about with it?

It was really hard for me to parse that headline. I'd instead suggest:

Hacker claims exfiltrating data on 680,000 French taxpayers.

> The ministry confirmed the intrusion the very next day

I think the title is OK but I'd probably have written e.g

"France's tax authority hacked, 680k taxpayers' data stolen"

These are the same people who want to identify you whenever you interact with a "social media" website.

I will never comply.

How, exactly, are these the same people?

Who are those people?

French government IT admins? Civil Servants?

Are you French?

Is the people on France's tax authority that want you identify somewhere?

Thankfully, the Constitutional Council struck down the social media ID bill today.

680k taxpayers is a pretty significant number. I wonder what kind of data was actually exposed and whether the affected people are being notified individually.

there was another leak recently and full data leaked. people having crypto got victim of home invasion , beatings, kidnapings, so much that france accounted for 70% of all crypto crimes the past years. and It wasnt for millions. people even with a few 10k$ in crypto got assaulted at their home.

Big government, big surface attack.

france is living through its own programmed obsolescence and it is 100% due to boomer generation locking in the vote to favor themselves instead of france future. can you believe that during covid governement pushed to raise retirements pensions by the inflation but forced to lock wages not to do that. they did that ONLY because boomers have the majority vote in this country. they also did the covid lockin for boomers, sacrifying all the youth generation to unemployement and debt.

France spends roughly 14% of its GDP on pensions for people that paid less than they now earning - literaly stealing money to young generations- , making pensions one of the country's largest public expenditures. The pension burden also appears inside the headline budgets of individual ministries: in 2026, about €25bn of the €90bn Education budget (~28%), €9.5bn of the €66.5bn Defence budget (~14%), €8.2bn of the €25.8bn Security/Police-Gendarmerie budget (~32%), and €2.4bn of the €13bn Justice budget (~18%) correspond to pension contributions.

So when France says it spends €90bn on schools, for example, only about €65bn is spending excluding the State pension contribution.

how is it related to obsolescence ? well if you are paid shit, have the highest tax in the world to make wealthy old people, why work hard? right now if you want to be working for the gov as an IT sec engineer you will earn less than an average civil servant working 35hours a week that just requires 0-2 year of post grade studies and you will be on a temp contract. there is literaly no decent engineer that will accept such a job. now scale that to many fields in france and see why this once great country is doomed

We should only allow vote for people that contribute to society or at least give them a stronger x2 x3 vote factor.

Same for retirement funds in france younger generations pay for the older ones but it appears that boomers did not make enough children for growth/equilibrium and are now earning more pensions than their children will. the logical thing to do is to decrease pensions for every boomer that has less than 2 children.

Census suffrage has been abolished about a century ago. There's a minor hack and you want to reinstate it.

> ... boomers ... boomers ...

Ah, just bigotry. I see.

what bigotry? they are stealing the money and future of every french child being born and you defend them insulting people showing you the facts of bigots.

You're indignant, and blame a group of people, based on a characteristic they cannot and did not choose, for the cause of you anger. But judging from the rest of your reply, you already know that.

You should look at the political system. Politicians, not only in France, have long ago found out that image is much more important than action, and that you can get a nice extra income when you serve rich people's interest. They bow to every rioting group, just to stay in power. Blame hypocritical politicians, yellow vests, or credulous voters, but not the Jews, the Blacks, the Muslims, or the Millenials.

i am actually a french muslim immigrant and all my life has been people like you - that likely identify as left and good willing people - telling me what to do and telling me i am indignant because I am uneducated or I dont follow what the common french leftist son of teacher thinks. The same thinking that made france irrelevant in 2026.

As for the boomers they totally choosing every of the characteristic I am talking about at every single vote they push. They are literaly the reason macron is in power and push for stuff like you know asking younger generations to work more than they did for less, paying more tax, getting bigger pensions, reducing unemployment benefits.

politicians are literaly elected by boomers that want to preserve their wealth and caste system.

There aren't terribly great differences in the electoral outcomes for age groups. 18-34 is a bit more to the left, the rest (including gen x and older millenials) are a bit more to the right. The difference between the two groups is about 15% (18-34 left: 43%, 35-99 left: 29%; 2024 elections, post election poll by IPSOS). There is a bigger difference, though: the younger people vote less often. They don't turn up.

> They are literaly the reason macron is in power

The reason Macron is in power is that the left opposition is weak, and the right opposition is fascist. Macron was the least of two evils.

> i am actually a french muslim immigrant

Then you should know that it is morally wrong to blame someone for having features they did not choose and cannot change.

Thing is they chose macron. They literally voted for him to remove from working people the same right they benefited. I do t inow why its hard for you To grasp. The data is public.

Liberté, égalité pas, fraternité

yeah. their fraternité ends when they need to fairly contribute.

> but forced to lock wages not to do that.

What does that mean exactly? State wages?

Who takes the fall for mistakes like this?

The system, so no one in particular, so it will never get better until individuals can be held accountable.

Policy makers make the policy that must be followed. Of course the engineers would take the brunt of blame, even though the engineering groups never make policy.

Its easy to say someone being personally responsible would fix the problem.. Really this just encourages further nefarious organizational behavior. I.e. hiring people into big titles who can't even understand their liability and railroading them into what an informal management actually wants as far as risk/cost trade offs which are then even higher toward risk as there is a scapegoat.

Let's presume this is a company, who would you say should take the fall for this?

The CEO will have to talk about it and manage the fallout. What else are you looking for.

Also, at this point we have no idea how they got in, until we know I think we should withhold judgement. Unless you consider yourself responsible if someone ever gets into a system you manage with a zero day.

Security is not an exact science, it's a trade-off between sensitivity of the data and the cost of protecting it whether you like it or not

Punishment isn't an exact science either, and there will be some arbitrary decisions that will be taken in order to find a trade-off between visibility and responsibility, whether you like it or not

Now do EES face and thumb scans.

Please-please, put it online for us to enjoy!

This will be bigger than the Panama Papers!

It is already. You can buy it online. There is not a lot of places where hackers sell that kind of stuffs.

1k lines are already shared, seems legit. Most of them is just <30k€ people. Only a handful of millionaires (8 >10M if I remember correctly), 0 billionaires. 2/3 people, 1/3 pro, there is no information about tax of professionals.

Seems to be an API endpoint about people who ask questions to the DGFiP.

>This will be bigger than the Panama Papers!

why?

this particular leak is pretty mundane information for a relatively low number of people. its not even the biggest leak out of france this year.

Reply on news.ycombinator.com