GoKawiilA hacker going by ZeroBytes claimed on Wednesday, on a forum frequented by cybercriminals, to have stolen nearly 680,000 rows of data extracted from an internal tool used by France's Directorate General of Public Finances. The ministry confirmed the intrusion the very next day.
The attack is not recent, however. It dates back to late June - the 26th, to be precise, according to the hacker - and the administration had detected and stopped it at the time, without ever saying a word publicly.
The stolen data includes names, dates of birth, addresses, and property and land registry information, covering around 390,000 individuals and 285,000 businesses. Passwords and banking details are not among the data reportedly taken.
ZeroBytes claims to have hopped from server to server before gaining VPN access - the remote entry point to the network - which then opened up several internal tax authority tools. The official version more drily describes an identity theft that enabled unauthorized access.
A second leak is also circulating on the same forums and is said to affect around 2 million property owners, though that one has no official confirmation yet.
ANSSI, the government's cybersecurity fire brigade, is investigating, and the CNIL has been notified as required by law.
This is far from the tax authority's first rodeo, though. Between late January and mid-February, hackers had already fraudulently accessed 1.2 million bank accounts in the FICOBA database, using the compromised credentials of an employee. Two breaches in one year is starting to add up.
For now, be wary of emails, text messages, and phone calls claiming to be from the tax authorities, especially if they rattle off your real personal details to gain your trust. An accurate address and a correct date of birth no longer prove anything at all.
It remains to be seen when each of the 680,000 people affected will receive a little notification letting them know their data is out in the wild.
Source : Cyberattaque.org