Sometime in late June, someone got into the servers of France’s Directorate General of Public Finances, the agency that holds the tax records of nearly every household and business in the country. By the time anyone in government noticed, the intruder had already come and gone. Investigators are still working out exactly what was taken, but early estimates put the number of affected taxpayers at roughly 678,000, spanning both individuals and businesses.
What makes this breach worth studying isn’t the headline number. It’s a single sentence buried in the French Ministry of Public Action and Public Accounts’ own statement: the agency’s access controls “failed to detect that these intrusions had led to data theft, due to the sophistication of the attack.”
That’s an admission worth sitting with. This wasn’t a case of a door left unlocked. The access controls were there. They were presumably doing what they were configured to do. And an attacker still walked out with the tax data of hundreds of thousands of people, undetected, for weeks.
The pattern is bigger than one agency
If this were an isolated incident, it would be a French domestic story. It isn’t. The DGFiP breach follows a February 2026 attack on France’s National Bank Account Registry, also housed under the tax collection agency, and a separate incident affecting the public education system earlier in the year. Three major breaches of French public infrastructure inside a single year is not a coincidence of bad luck; it’s a signal that something structural in how these systems are monitored isn’t holding.
The response has been significant. French Prime Minister Sébastien Lecornu ordered an audit of government cybersecurity readiness and directed the national cybersecurity agency, ANSSI, to build a dedicated crisis-response capability. That capability now exists: on September 7, ANSSI announced REACTIV, Interministerial Response & Action against Data Breaches, which gives ANSSI new authority to force ministries to take immediate protective action during an incident and to run centralized crisis communications when state services are threatened.
REACTIV is a reasonable, arguably overdue, piece of institutional plumbing. But it’s worth being precise about what it fixes and what it doesn’t. REACTIV is designed to make the response to a confirmed breach faster and better coordinated. It says nothing about how long it takes to confirm that a breach happened in the first place. And in this case, that gap was the entire problem: the intrusion occurred in late June, but the DGFiP’s own statement suggests the theft itself went undetected by the systems designed to catch it, only surfacing publicly in mid-August after a hacker calling themselves “ZeroBytes” claimed responsibility and reportedly began selling the data.
Detection and response are not the same investment
Security budgets have spent the better part of two decades weighted toward prevention: firewalls, access controls, endpoint protection, identity governance. These are necessary, and no one is arguing otherwise. But prevention tools are built to stop known bad behavior at the point of entry. They are not built to notice a legitimate-looking session quietly pulling structured data out of a system it has valid access to. That’s a detection problem, and detection requires a fundamentally different posture: continuous, active hunting for the behaviors that don’t match a baseline, rather than waiting for a rule to trip.
This is where the “assume breach” mindset that’s become common in mature security programs earns its keep. It isn’t a slogan; it’s an operating assumption that changes what you build. If you assume your perimeter will eventually be crossed, you stop measuring success by how few alerts fire and start measuring it by how quickly an anomalous pattern gets found, investigated, and shut down once something is already inside. Dwell time, the gap between initial compromise and detection, is the metric that actually predicts how much damage a breach does. A well-resourced access control stack that takes weeks to notice unauthorized extraction of taxpayer data is, functionally, a detection stack that hasn’t been asked to do its job yet.
What this means beyond France
Government agencies are an easy target for public criticism, but the DGFiP’s situation isn’t unique to government IT. Any organization running a mature, well-funded security stack can find itself in the same position: controls that are technically functioning, logging that is technically capturing events, and an attacker who still operates undetected for weeks because nothing in the environment is actively looking for the specific pattern of “valid access being used for an invalid purpose.”
The lesson isn’t that access controls don’t matter. It’s that access controls answer the question “can this person get in?”, and a huge, growing share of real-world breaches don’t hinge on that question at all. They hinge on what happens after legitimate-looking access is already granted, whether through stolen credentials, a compromised VPN session, or an insider abusing standing privileges. Answering that second question requires people and technology whose entire job is to hunt for the anomaly, not just log it.
France now has a faster way to respond once a breach is confirmed. The harder, less visible work, building the continuous detection capability that would have caught the DGFiP intrusion in week one instead of week eight, is the part that doesn’t come with a press release. It’s also the part that will determine whether the next headline is about a breach that was stopped in hours, or one that, once again, was only discovered because the attacker decided to announce it.