An ethical hacker who says he communicated with the cybercriminal behind the French tax office breach claims the stolen database has already been sold, according to tf1info.fr.
The hacker told TF1 that he was able to exchange messages with the attacker, who stated the data set has already changed hands. The report does not specify who bought the database or what price was paid.
The breach targeted France's public finance directorate, known as DGFiP. French media, including La Provence and RMC, have reported that the tax authority is now preparing to contact affected individuals by email to confirm whether their personal data was exposed.
According to Le Figaro, the administration was expected to begin notifying victims on Monday. The notifications are meant to help taxpayers determine if their information was compromised in the incident.
RTL reported that a cyberintelligence expert described the perpetrator as motivated primarily by financial gain, adding that the attackers were "not geniuses." The expert's comments suggest the breach was opportunistic rather than the work of a highly sophisticated group.
The stolen data could be used for fraud, and French outlets have advised affected taxpayers to remain vigilant against phishing attempts and identity theft. The DGFiP's email notifications are part of a broader effort to limit the damage from the leak.
The sale of the database raises the risk that the stolen information will be used in targeted scams in the coming weeks. Authorities have not yet confirmed the full scope of the breach or identified the buyer. Observers will be watching for further disclosures from the tax office about which records were taken and how the attack was carried out.
