The National Cybersecurity Agency (Anssi) published a detailed investigation on Thursday into recent data thefts at the General Directorate of Public Finances (DGFiP).
According to Anssi, the hacker exploited several dozen accounts belonging to tax agents, whose credentials were likely stolen through viruses. This method allowed the attacker to bypass certain basic protections that were missing from the system.
The agency also emphasized that the monitoring of abnormal behaviors within the IT systems was insufficient, which facilitated intrusions and data theft.
This investigation highlights significant security flaws at the tax authority, calling for strengthened protection measures and improved detection of suspicious activities.