French tax office hack: stolen passwords were enough, lessons for African administrations

This summer, France’s public finance directorate (DGFiP), the country’s tax administration, suffered one of the most embarrassing hacks in its history. On Tuesday 29 September, ANSSI, the agency in charge of the French state’s cybersecurity, published its incident report, some twenty pages commissioned by Prime Minister Sébastien Lecornu. Its conclusion fits in one sentence: the attack owed nothing to a sophisticated technique, and everything to weaknesses in three areas, identity, network architecture and detection.

The toll is heavy. According to ANSSI, the stolen data concerns nearly 353,000 individuals and 252,000 businesses, extracted from E-Contact, the tool that lets officials exchange messages with taxpayers. A second theft hit land registry data. The case became public on 12 August, when a hacker calling themselves Zerobytes claimed the theft on a forum. Two suspects aged 16 and 18 were arrested at the end of August; one has been charged and remanded in custody.

The first suspicious connections date back to May, from addresses located in France and India. On 13 August, the same hacker claimed a second haul, taken from the land registry data service: according to them, the names, dates of birth, plots and property of 2 million French people. The figures also differ: ANSSI counts about 605,000 users affected by the first theft, while the hacker claimed 678,000.

The hacker had the keys

The attacker forced no door: they had the passwords. Over three months, they obtained the credentials of several dozen officials, close to thirty accounts in total. ANSSI found no attempt to guess passwords by trial and error, proof that the attacker already knew them. They were most likely stolen by “infostealers”, spyware installed on computers the DGFiP did not manage, notably officials’ personal devices.

Two of the tax office’s portals asked only for a username and password, with no second factor. A third, reserved for partners such as land surveyors, used a code sent by email: compromising the computer of a surveyor in a private firm was enough to get around that protection and empty the land registry data between 27 July and 8 August. The DGFiP was paying a contractor to monitor the resale of credentials online. But that watch does not cover every marketplace, and sometimes reacts late: an account spotted on 3 June only had its password changed nine days later.

Infostealers have become one of the main sources of hacked accounts worldwide. These small programs often hide in pirated software, fake free tools or attachments. Once installed, they suck up the passwords and sessions saved in the browser within seconds, then send them to their authors, who sell them in bulk. An official checking work email from an infected family computer thus unknowingly hands over the keys to their administration. And as long as the machine is not cleaned, changing the password is almost useless.

Warning signs nobody saw

To extract the data, the hacker used “scraping”: a program that opens records one by one to copy them. Eleven gigabytes left between 22 and 25 June, then three more at the end of July, without triggering a single alert. Yet the connections took place in the middle of the night, through virtual private networks (VPNs), from India or from addresses already known for malicious activity. And every record copied required a request: no limit curbed this unusual flow. A cap on the number of requests per user, a technique as old as it is simple, would have slowed the scraping and raised an alert long before thousands of records left the tax office.

The portal used for the theft was simply not monitored by the DGFiP’s security operations centre. To reach it, the hacker went through the network that links French administrations together, from hacked infrastructure belonging to the Education ministry. With no segmentation, nothing then separated them from the tax office’s sensitive applications. Yet as early as 9 June, the Education ministry had sent other ministries a list of technical indicators, including an address used by the attacker.

Even the responses failed. On the evening of 23 June, suspicious searches did trigger an alert. The account’s password was reset the next morning, but the session already open was not cut off, and the theft continued until 25 June. In July, the account used was only reset two days after the thefts resumed. A report of compromised accounts sent on 15 June had gone unanswered. ANSSI itself admits that its own sensors, which watch network traffic rather than what happens inside applications, could not spot an intruder using real accounts.

Emergency measures have already been taken. Since August, DGFiP officials no longer have access to the compromised portals, and two-factor authentication is due to be rolled out everywhere by the end of the year. A full audit of the tax office’s systems, ordered in August by the Prime Minister, is to list all remaining vulnerabilities. ANSSI also stresses staff awareness: a user told that their account has been compromised must know what to do, starting with having the infected device cleaned.

Flaws also found in Africa

Nothing in this attack is specific to France. Remote work on personal computers, portals protected by a mere password, networks shared between ministries and security centres that only watch part of the systems exist in many African administrations, which are rapidly digitising taxes, civil registration, land registries and public payments. Credential thieves know no borders: stolen accounts are sold on the same marketplaces. That is the report’s main lesson: a system’s security depends first on protecting the identities of the people who use it.

ANSSI’s remedies have one advantage: most of them do not require big budgets. Turning on two-factor authentication on exposed portals, blocking access from unmanaged devices, setting viewing limits and cutting sessions after a password change are matters of discipline rather than investment. The report also shows that a single weak link, here a partner firm’s computer, can open the door. Administrations that give access to notaries, surveyors or contractors would do well to review their own rules.