French Tax Data Theft: Weak Passwords and Seven Weeks Unnoticed

France's national cybersecurity agency, ANSSI, has published a report on the theft of data from the country's tax administration (DGFIP). An attacker used stolen staff passwords to reach tax data on a little over 350,000 individuals and more than 250,000 businesses in June and July. Neither the tax administration nor ANSSI saw the data leave.

Contrary to the ministry's earlier claim that blamed "the sophistication of the attack," ANSSI concludes the opposite: the breach succeeded because of weak login protection, poorly separated networks and gaps in monitoring.

How they got in

The data came from E-Contact, the tool taxpayers use to message the DGFIP. For individuals it may have included the tax ID, contact details, family situation, reference income and withholding rate, plus a list of messages; for fewer than 250 people, the message content itself. For businesses it covered the company name, SIREN number and address; message content for fewer than 2,076 firms. Taxpayers' own accounts and passwords were not compromised.

Several dozen staff passwords were probably lifted by infostealers from personal, unmanaged devices. The PIGP and ADER portals asked only for a password, so a stolen one worked at once. The attacker reached the inter-ministry network RIE through compromised Education ministry systems; sensitive DGFIP applications were not walled off from the rest. The accounts used had no special privileges yet could reach a vast amount of data.

A second route led to land-registry data through APEX. A land surveyor's computer at a private firm was apparently compromised, letting the attacker bypass a one-time code. That data concerns nearly 435,000 households.

Why no one noticed

The DGFIP had a routine for stolen logins: its security operations center (SOC) reset the password of a compromised account. It caught some activity but not the theft. On June 23 a reset cut off PIGP access but did not end the open ADER session — data kept flowing for almost 16 more hours. The SOC was not watching ADER at all.

Nothing tied the warning signs together — night logins, VPN connections, addresses in India, known malicious addresses. Neither data volumes (11 GB over three days in June) nor the number of requests were checked, though scraping needs one request per page. On their own such signals cause false alarms, but together they could have raised an alert.

ANSSI's own sensors sit only at network entry and exit points, and it has no access to application logs. The theft came to light only on August 12, when the attacker claimed it on a forum — seven weeks after the first batch was taken.

What has changed

Staff access to ADER and PIGP is shut and will not be reopened; APEX is locked. ANSSI recommends revoking every active session whenever a password is reset; enabling multi-factor authentication on every application (an emailed code is useless if the same password opens the mailbox); collecting all business-application logs in a SIEM with quotas on data accessed; and barring personal devices from work resources.

Source: The Hacker News