> "The attack is not recent, however. It dates back to late June - the 26th, to be precise, according to the hacker - and the administration had detected and stopped it at the time, without ever saying a word publicly."

I thought GDPR mandated disclosure of data breaches involving PII. Is France's tax authority somehow exempt?

edit to add: Article 33 particularly,

https://gdpr.eu/article-33-notification-of-a-personal-data-b...