French tax authority admits data heist after crook touts 2M records

France's tax authority (DGFiP) confirmed that an intruder accessed and extracted data in June after an alleged attacker using the alias "ZeroBytes" posted a purported 2 million-record taxpayer database on a cybercrime forum, claiming use of stolen credentials and an MFA bypass; DGFiP says the access was severed at the end of June and disputes claims of continued access while investigations to determine affected data and users continue, and the incident will be reported to CNIL. The article notes this breach as part of a series of large compromises against French government services earlier in the year.