So here’s a cringe-worthy cyber saga: someone used stolen passwords from staff at France’s tax authority to siphon off tax messages and register details for hundreds of thousands of people and businesses — and it took weeks before anyone realised the data were gone. Spoiler: the hacker didn’t need to be a wizard, just patient and lucky with sloppy security.

What happened (in plain English)

Between late spring and mid-summer, an attacker moved through internal portals and grabbed messages from the tax administration’s contact tool. The haul included records tied to roughly 350,000 individuals and about 250,000 companies. Separately, land-registry information affecting nearly 435,000 households was taken via a partner portal.

How did they do it? Two simple routes:

  • One route relied on dozens of staff logins that were quietly stolen over months — likely by malware that copies saved credentials from personal or unmanaged devices. Those accounts gave access to internal portals where messages and contact data live.
  • The other route used a partner gateway for professionals (notaries, surveyors). That portal asked for a password and an email one-time code — but an infected partner machine let the attacker bypass the email code.

Crucially, the messaging tool being scraped had no second login step, and several internal applications weren’t separated from each other. Because the intruder used real staff accounts, some detection systems didn’t flag the activity as clearly malicious.

The break-in started in May, automated scraping pulled pages in late June, and activity spiked again in July. The attacker publicly boasted about the theft in August — and only then did an in-depth audit and broader shutdowns happen. During cleanup, some portals were blocked and partner accounts disabled, which caused noticeable service disruption.

Why it worked — and what actually helps

The attack succeeded not because it was flashy, but because of boring, preventable failures: single-factor logins, poorly separated networks, and monitoring that didn’t connect the dots. Security teams spotted suspicious logins at times, reset passwords, but didn’t revoke live sessions or correlate alerts across portals — so the attacker just kept scraping for hours or days on end.

Here’s a sensible action list (translated from the technical recommendations, but in human):

  • Revoke every active session when a password is reset — don’t just change the locks without kicking out the intruder.
  • When an account is reported compromised, retroactively check everything it did from the likely start date — find the breadcrumbs.
  • Deploy multi-factor authentication everywhere, and pick a second factor that still protects the account if the password is stolen. Email codes aren’t strong if the attacker can reach that inbox; hardware tokens or separate-device authenticator apps are better.
  • Log and monitor every business application in a central system (SIEM). Set sensible quotas and alarms for unusual volumes of records accessed, requests made, and data transferred.
  • Block access from unmanaged personal devices — keep work stuff off home laptops and unknown machines.
  • Correlate signals (night logins, unusual IPs, VPN use, request rates). Alone they cause false alarms; together they’re a screaming neon sign.

No one likes having to learn the same lesson twice: treat credentials like keys to a vault, not a doormat. With a handful of practical changes — better second factors, session revocation, tighter monitoring, and keeping personal devices out — this kind of slow, boring data theft becomes a lot harder and a lot less fun for attackers.