FRA9 · 18/08/2026 · Digital & artificial intelligence
French tax-system breach: what users should watch
The CNIL’s 18 August notice confirmed DGFiP breach notifications. September’s follow-up states that impots.gouv.fr and users’ personal and professional spaces were not compromised.
Archive photograph · 2006-11 · Pline · CC BY-SA 3.0. Pline ↗
Separate sources, scopes and actions
These are document dates, not dates of closure or of a new breach.
| Dated source | What it establishes | Do not infer |
|---|---|---|
| CNIL · 18 August | Notification already received | Current investigation status |
| DGFiP · 14 September | Site and user spaces not compromised | No internal data theft |
| Individual FAQ · 24 August | Password not stolen | No personal data exposed |
| Business FAQ · 24 August | Scope depends on notification | All accounting records hacked |
| DGFiP · 25 August | Guidance and complaint if harmed | Automatic compensation |
See the essentials at a glance
Updated
FRA9Editorial standardsReport a correction
Reading time estimates the main text; tables, tools, references and questions take additional time.
key points: 18 August CNIL notice · 14 September DGFiP update · Public account spaces not compromised · Vigilance and evidence
The 18 August CNIL notice remains a dated statement
On 18 August 2026, CNIL confirmed notification of DGFiP data breaches and described possible checks. Its request not to duplicate individual complaints allowed an exception for useful evidence. That dated notice establishes neither closure nor the precise state of an investigation on 18 October; retain its date when describing what the authority said.
The internal system is not the public website
DGFiP’s page published on 14 August and updated on 14 September 2026 distinguishes internal-system access from impots.gouv.fr and personal/business spaces, which it says were not compromised. It also identifies a separate vacant-estate portal incident. Do not combine those scopes into a claim that every taxpayer account or the entire public website was hacked.
Individuals: read the notice about the affected data
The 24 August individual FAQ distinguishes tax identifiers, civil-status details and tax circumstances from the login password, which it says was not stolen. Someone knowing a tax detail is therefore not proof of identity. Read your notification and reach the official account directly; the general list cannot establish which information was extracted about you personally.
Businesses: do not infer that all returns were stolen
The 24 August business FAQ separates company and messaging information from returns, payments and banking details, which it says were not accessed. Some message-content access received specific notices. Have the authorised person examine the notification: neither a known SIREN nor this general account establishes that all accounting records or electronic-invoicing infrastructure were compromised.
When contacted, verify before responding
Cybermalveillance advises reading the organisation’s notice and confirming its authenticity when needed. Leaked details can make phishing convincing. Do not give secrets to an urgent caller; reach the service independently. If a password actually leaked, change it on other accounts where reused too. That general conditional advice is not evidence that a tax-account password leaked in this incident.
Actual harm calls for a separate response
DGFiP’s 25 August guidance points to 17Cyber for situation-specific orientation and appropriate complaint routes when harm occurs. Keep useful messages, addresses and screenshots. Notification to CNIL is not your personal criminal complaint, and avoiding duplicate incident complaints does not mean ignoring fraud against you. No compensation, recovery timetable or investigation outcome is guaranteed by this guide.
Read next
