French Tax Administration Data Breach via Stolen Staff Credentials Uncovered After Seven Weeks

A French tax administration data breach occurred through stolen staff credentials, exposing data of 350,000 individuals and 250,000 businesses over seven weeks. The attack went undetected due to weak login protections, network segmentation issues, and inadequate monitoring despite multiple alerts.

An attacker used stolen passwords of staff at France's tax administration to take tax data on hundreds of thousands of taxpayers and businesses in June and July.

Neither the tax administration nor France's national cybersecurity agency saw the data leave. The attack was not sophisticated, the agency, ANSSI, says in a report (in French) published on Tuesday: it worked because of weak

Read original article