The CNIL investigates the hacking of the tax information system affecting fiscal and cadastral data
The National Commission on Informatics and Liberty (CNIL) has been notified of a data breach affecting the information system of the Directorate General of Public Finances (DGFiP).
On August 14, 2026, the Ministry of Economy and Finance revealed that a data breach allowed a third party to access and extract information related to individuals and professionals. The compromised data includes fiscal information (reference income, family quotient, withholding tax rate, SIREN and company name) and cadastral data (addresses and property areas). Identifiers and passwords are reportedly not affected. The ministry notified these breaches to the CNIL and committed to individually inform the concerned persons.
The CNIL, being seized of these breaches, specified that it is no longer necessary to send individual complaints on this matter, unless specific elements useful for investigations are available. The authority may conduct audits to verify the compliance of security measures. If breaches of the GDPR or the Data Protection Act are found, sanctions could be imposed on the data controllers.
On August 14, 2026, the Ministry of Economy and Finance revealed that a data breach allowed a third party to access and extract information related to individuals and professionals. The compromised data includes fiscal information (reference income, family quotient, withholding tax rate, SIREN and company name) and cadastral data (addresses and property areas). Identifiers and passwords are reportedly not affected. The ministry notified these breaches to the CNIL and committed to individually inform the concerned persons.
The CNIL, being seized of these breaches, specified that it is no longer necessary to send individual complaints on this matter, unless specific elements useful for investigations are available. The authority may conduct audits to verify the compliance of security measures. If breaches of the GDPR or the Data Protection Act are found, sanctions could be imposed on the data controllers.
Informations complémentaires
L’analyse complète est réservée aux membres
Montant de la sanction, thèmes, secteurs, entités et données concernées : l’essai gratuit de 14 jours ouvre la fiche entière et la veille personnalisée.
Essayer gratuitement 14 jours · accès complet · sans carte bancaire