Part 2 of the 3 post series
Published: August 24, 2026
Estimated Reading Time: 11 minutes
Categories: Cyber Warfare / Identity & Access Management / Public Sector Breach / API Security
If Part 1 of this series exposed the cracks in France’s political facade of “digital sovereignty,” the events of June and July 2026 shattered any remaining illusions of operational readiness. The devastating cyberattack on the DGFiP (Direction générale des Finances publiques)—the crown jewel of the French bureaucratic machine—coupled with a simultaneous security breach of the state-mandated messenger Tchap, has delivered a brutal wake-up call to Paris.
When the threat actor known as “ZeroBytes” dumped the stolen databases onto an underground hacking forum in mid-August, the narrative of a secure, sovereign open-source state collapsed. This was not a sophisticated, state-sponsored cyber espionage operation utilizing million-dollar zero-day exploits. It was a textbook exploitation of systemic infrastructural rot.
🛡️ Anatomy of a GAU: What Happened to the DGFiP?
The DGFiP is responsible for managing the tax records, real estate registers, and financial transactions of every citizen and corporation in France. It is, by definition, a high-value target. Yet, its defensive perimeter failed at the absolute baseline: Identity and Access Management (IAM).
The Initial Access Vector
The attackers did not breach a firewall or exploit a flaw in an open-source operating system. They simply walked through the front door using compromised credentials belonging to a legitimate DGFiP internal agent and an authorized external IT contractor. These credentials had been harvested weeks prior via standard corporate phishing campaigns and commodity infostealer malware circulating on the dark web.
Equipped with these valid logins, ZeroBytes connected directly to the government’s internal Virtual Private Network (VPN).
The Exfiltration Sweep
Once inside the state network (Réseau Interministériel de l’État – RIE), the attackers targeted the application layer. They found themselves in an environment completely devoid of internal compartmentalization or behavioral monitoring.
- The First Haul: The attackers queried core financial databases, exfiltrating the highly sensitive tax profiles of 678,000 citizens and enterprises. Stolen data points included tax reference incomes (Revenu fiscal de référence), family coefficients (Quotient familial), corporate SIREN numbers, and live withholding tax rates.
- The Second Haul: Days later, the actors pivoted to the SPDC (Service de la publicité foncière et de l’enregistrement), the online portal governing national land and estate registries. Here, they scraped an additional 200,000 accounts, extraction-mapping inheritance records (successions) and real estate ownership data.
The Detection Failure
The most damning aspect of the DGFiP breach is the timeline. Internal IT security noticed unusual access patterns in June and July and revoked the compromised accounts. However, the internal auditing teams concluded that no data had been exfiltrated. It was only when ZeroBytes put the complete, verified SQL databases up for sale in August that the ministry was forced to acknowledge the catastrophic extent of the data flight.
🔐 The Internal IAM Crisis: A Tale of Two Realities
The DGFiP hack exposes a profound, schizoid split in France’s approach to digital identity.
On the citizen-facing side (B2C), France boasts world-class security. Portals like FranceConnect+ utilize modern OpenID Connect federations. For sensitive transactions, they mandate cryptographic multi-factor authentication (MFA) linked to the France Identité smartphone app, which reads the physical NFC chip of the new national ID card.
On the internal employee and contractor side (B2E/B2B), however, the infrastructure is a decaying museum of IT history:
- Monolithic Legacy Directories: Employee identities are managed via a deeply tangled, nested Active Directory and LDAP labyrinth. These directories have been hastily merged over decades as various ministries and regional subdivisions were consolidated.
- The MFA Vacuum: In June 2026, while citizens were forced to use hardware-backed eIDAS-compliant authentication, multi-factor authentication was not systematically enforced for internal civil servants. Massive swathes of internal networks—including access to sensitive fiscal databases—depended entirely on a single static username and password combination.
- Coarse-Grained Authorization: The internal IAM relies on outdated Role-Based Access Control (RBAC) tied strictly to organizational charts, rather than modern, contextual Attribute-Based Access Control (ABAC). Once a user account is authenticated, it is granted broad, blanket trust to query thousands of records without secondary verification.
💬 The Tchap Breach: The Death of the “Open Source is Inherently Secure” Dogma
To make matters worse for DINUM, the open-source flagship itself was targeted. Tchap, the encrypted messaging application developed explicitly for government communication and built on the open-source Matrix protocol, was breached by an actor going by the handle “Misère”.
Over 73,000 government and ministerial accounts were compromised. The attacker did not break the underlying Matrix end-to-end encryption algorithms. Instead, they exploited structural flaws in how the French state implemented user lifecycle management and API authentication within their custom infrastructure.
The Tchap incident effectively weaponizes a hard truth against the IT branch: open-sourcing your code does absolutely nothing to protect you if your operational deployment, configuration, and perimeter control are fundamentally broken.
📌 Conclusion of Part 2
The DGFiP and Tchap hacks are the ultimate equalizer in the digital sovereignty debate. They prove that operating system dogmas and open-source manifestos are completely useless if an organization fails at basic cyber hygiene. The French state spent millions planning a transition to Linux desktops while leaving its core financial applications unprotected by basic multi-factor authentication, rate-limiting, or competent exfiltration logging.
Leave a Reply