France’s tax agency lost data on 678,000 people to a stolen login
The French tax agency says an attacker took data belonging to 678,000 individuals and businesses. The intrusions happened in June and July. The agency did not establish that anything had left its systems until the attacker said so in August.
The Direction générale des Finances publiques set out what the attacker reached in a statement on 14 August. For individuals, that means reference tax income, family quotient, and withholding tax rate. For companies, it means the registered name and the SIREN number. The attacker also consulted cadastral records covering the addresses and floor areas of properties.
The agency was equally specific about what held. The intrusions did not compromise personal or professional accounts on impots.gouv.fr. The attacker took no taxpayer usernames and no passwords.
Credentials, not a zero-day
The way in was not a software flaw. Bercy says the attacker used the stolen identifiers of a DGFiP employee and of...
Copyright of this story solely belongs to thenextweb.com. To see the full text click HERE
