French tax authority cyberattack blamed on outdated systems and underfunding

The French tax authority, DGFiP, has suffered a significant cyberattack, resulting in the theft of data belonging to at least 678,000 individuals and professionals, as well as approximately 200,000 cadastral accounts. The breaches occurred in late June and late July, with the full extent of the data compromise only confirmed recently.

Solidaires Finances Publiques, a union representing tax employees, has strongly criticized the DGFiP's IT infrastructure, attributing the security failures to "technical debt." This debt, they explain, stems from the "age of certain components of our information system and our security models." The union points out that these vulnerabilities had previously been flagged by the Court of Auditors and the General Inspectorate of Finances.

Furthermore, the union argues that the constant push for digitization, increased data sharing, remote access, and interconnectedness has not been matched by adequate security resources. They contend that this "policy of always more digital" without sufficient funding for security is a primary reason why cybercriminals could extract data undetected for extended periods.

In response to the incident, Sébastien Lecornu, the relevant minister, has commissioned an "in-depth audit" from the National Cybersecurity Agency (ANSSI). Solidaires Finances Publiques, however, urges for more than just promises, calling for a national debate on digitization and data security. They criticize decades of budget cuts aimed at reducing public spending, arguing that these cuts have directly contributed to the current crisis and eroded public trust in state institutions.