FRA9 · 18/08/2026 · Digital & artificial intelligence
French tax-system breach: what users should watch
The CNIL is investigating data breaches reported by the tax authority; an individual CNIL complaint is not required at this stage.
The CNIL is investigating data breaches reported by the tax authority; an individual CNIL complaint is not required at this stage.
What happened
The CNIL is investigating data breaches reported by the tax authority; an individual CNIL complaint is not required at this stage. This FRA9 file is dated 18 August 2026 and is based on CNIL, the reference source listed at the end of the page.
The key markers
DGFiP · CNIL · Données · Phishing: these markers define the announcement’s immediate scope. A digital development becomes concrete when it changes accessible data, permissions, traceability or service accountability. They should be read together rather than reducing the story to one number or name.
Why it matters
The practical risk is phishing that uses plausible tax details to obtain passwords or payments. The practical issue is therefore not the headline alone, but how the measure, figure or event changes an actual decision.
Who is affected?
Individuals, developers, employers, platforms and public bodies have different duties and levels of exposure. Nationality, residence, status, age or the date of a case may still change an individual answer.
What to verify
Open the official domain yourself, review permissions, retain useful evidence and avoid links or payments requested in unexpected messages. Keep the official address and any useful confirmation; old screenshots and secondary posts can remain online after an update.
What comes next
Do not follow links in messages; open impots.gouv.fr yourself and change any reused password. Follow the next checkpoint on CNIL; if timing or rules change, that source should be checked before spending money or submitting anything.
Read next
