I worked as a temp for france tax collection before my degree (circa 2012-2013l.
People were registered in 3 different database, each of them independent, each of them on a different software (one aspnet/vbnet you connected through a browser, one very, very old, clearly IBM software, and the third one was probably as old as IBM, if not older, but looked like a minitel portage on windows). All the relevant data were dispersed on those three (a fourth one existed but only authorised people could use it because you had bank account numbers on it). Also, only the Vbnet software allowed copy paste, which means that to find someone, you had to file the tax number+surname 3 time, without making any mistake.
I wonder which one was broken into. No bank details, so it probably was one I had access to as a temp. Maybe they upgraded their software though, because if I remember correctly only they all worked on the local network (not sure about the aspnet one).
680k taxpayers is a pretty significant number. I wonder what kind of data was actually exposed and whether the affected people are being notified individually.
there was another leak recently and full data leaked. people having crypto got victim of home invasion , beatings, kidnapings, so much that france accounted for 70% of all crypto crimes the past years. and It wasnt for millions. people even with a few 10k$ in crypto got assaulted at their home.
> "The attack is not recent, however. It dates back to late June - the 26th, to be precise, according to the hacker - and the administration had detected and stopped it at the time, without ever saying a word publicly."
I thought GDPR mandated disclosure of data breaches involving PII. Is France's tax authority somehow exempt?
In the article I read about this it appears that they only found out now. They apparently launched an investigation and discovered the breach after being contacted by the hacker
Well it certainly lends credence to the opinion that GDPR and similar regulations are mostly designed for EU revenue generation by extracting fines from American tech companies. The actual privacy protections are secondary.
Having worked in multiple EU companies that went to great effort to comply with GDPR and also had legitimate issues that needed to be resolved under threat of real fines, this is just an incorrect take.
Its easy to say someone being personally responsible would fix the problem.. Really this just encourages further nefarious organizational behavior. I.e. hiring people into big titles who can't even understand their liability and railroading them into what an informal management actually wants as far as risk/cost trade offs which are then even higher toward risk as there is a scapegoat.
Policy makers make the policy that must be followed. Of course the engineers would take the brunt of blame, even though the engineering groups never make policy.
Let's presume this is a company, who would you say should take the fall for this?
The CEO will have to talk about it and manage the fallout. What else are you looking for.
Also, at this point we have no idea how they got in, until we know I think we should withhold judgement. Unless you consider yourself responsible if someone ever gets into a system you manage with a zero day.
Security is not an exact science, it's a trade-off between sensitivity of the data and the cost of protecting it whether you like it or not
Punishment isn't an exact science either, and there will be some arbitrary decisions that will be taken in order to find a trade-off between visibility and responsibility, whether you like it or not
It is already. You can buy it online. There is not a lot of places where hackers sell that kind of stuffs.
1k lines are already shared, seems legit.
Most of them is just <30k€ people. Only a handful of millionaires (8 >10M if I remember correctly), 0 billionaires. 2/3 people, 1/3 pro, there is no information about tax of professionals.
Seems to be an API endpoint about people who ask questions to the DGFiP.
france is living through its own programmed obsolescence and it is 100% due to boomer generation locking in the vote to favor themselves instead of france future. can you believe that during covid governement pushed to raise retirements pensions by the inflation but forced to lock wages not to do that. they did that ONLY because boomers have the majority vote in this country. they also did the covid lockin for boomers, sacrifying all the youth generation to unemployement and debt.
France spends roughly 14% of its GDP on pensions for people that paid less than they now earning - literaly stealing money to young generations- , making pensions one of the country's largest public expenditures. The pension burden also appears inside the headline budgets of individual ministries: in 2026, about €25bn of the €90bn Education budget (~28%), €9.5bn of the €66.5bn Defence budget (~14%), €8.2bn of the €25.8bn Security/Police-Gendarmerie budget (~32%), and €2.4bn of the €13bn Justice budget (~18%) correspond to pension contributions.
So when France says it spends €90bn on schools, for example, only about €65bn is spending excluding the State pension contribution.
how is it related to obsolescence ? well if you are paid shit, have the highest tax in the world to make wealthy old people, why work hard? right now if you want to be working for the gov as an IT sec engineer you will earn less than an average civil servant working 35hours a week that just requires 0-2 year of post grade studies and you will be on a temp contract. there is literaly no decent engineer that will accept such a job. now scale that to many fields in france and see why this once great country is doomed
We should only allow vote for people that contribute to society or at least give them a stronger x2 x3 vote factor.
Same for retirement funds in france younger generations pay for the older ones but it appears that boomers did not make enough children for growth/equilibrium and are now earning more pensions than their children will. the logical thing to do is to decrease pensions for every boomer that has less than 2 children.
what bigotry? they are stealing the money and future of every french child being born and you defend them insulting people showing you the facts of bigots.
I worked as a temp for france tax collection before my degree (circa 2012-2013l.
People were registered in 3 different database, each of them independent, each of them on a different software (one aspnet/vbnet you connected through a browser, one very, very old, clearly IBM software, and the third one was probably as old as IBM, if not older, but looked like a minitel portage on windows). All the relevant data were dispersed on those three (a fourth one existed but only authorised people could use it because you had bank account numbers on it). Also, only the Vbnet software allowed copy paste, which means that to find someone, you had to file the tax number+surname 3 time, without making any mistake.
I wonder which one was broken into. No bank details, so it probably was one I had access to as a temp. Maybe they upgraded their software though, because if I remember correctly only they all worked on the local network (not sure about the aspnet one).
It was really hard for me to parse that headline. I'd instead suggest:
Hacker claims exfiltrating data on 680,000 French taxpayers.
> The ministry confirmed the intrusion the very next day
I think the title is OK but I'd probably have written e.g
"France's tax authority hacked, 680k taxpayers' data stolen"
These are the same people who want to identify you whenever you interact with a "social media" website.
I will never comply.
Are you French?
Is the people on France's tax authority that want you identify somewhere?
How, exactly, are these the same people?
Who are those people?
French government IT admins? Civil Servants?
680k taxpayers is a pretty significant number. I wonder what kind of data was actually exposed and whether the affected people are being notified individually.
there was another leak recently and full data leaked. people having crypto got victim of home invasion , beatings, kidnapings, so much that france accounted for 70% of all crypto crimes the past years. and It wasnt for millions. people even with a few 10k$ in crypto got assaulted at their home.
> "The attack is not recent, however. It dates back to late June - the 26th, to be precise, according to the hacker - and the administration had detected and stopped it at the time, without ever saying a word publicly."
I thought GDPR mandated disclosure of data breaches involving PII. Is France's tax authority somehow exempt?
edit to add: Article 33 particularly,
https://gdpr.eu/article-33-notification-of-a-personal-data-b...
Rules for thee not for me.
In the article I read about this it appears that they only found out now. They apparently launched an investigation and discovered the breach after being contacted by the hacker
Now you are realizing that some "rules" don't apply to others.
Well it certainly lends credence to the opinion that GDPR and similar regulations are mostly designed for EU revenue generation by extracting fines from American tech companies. The actual privacy protections are secondary.
That'll be the GDPR that protects my privacy and fines people that fuck about with it?
Having worked in multiple EU companies that went to great effort to comply with GDPR and also had legitimate issues that needed to be resolved under threat of real fines, this is just an incorrect take.
Who takes the fall for mistakes like this?
The system, so no one in particular, so it will never get better until individuals can be held accountable.
Its easy to say someone being personally responsible would fix the problem.. Really this just encourages further nefarious organizational behavior. I.e. hiring people into big titles who can't even understand their liability and railroading them into what an informal management actually wants as far as risk/cost trade offs which are then even higher toward risk as there is a scapegoat.
Policy makers make the policy that must be followed. Of course the engineers would take the brunt of blame, even though the engineering groups never make policy.
Let's presume this is a company, who would you say should take the fall for this?
The CEO will have to talk about it and manage the fallout. What else are you looking for.
Also, at this point we have no idea how they got in, until we know I think we should withhold judgement. Unless you consider yourself responsible if someone ever gets into a system you manage with a zero day.
Security is not an exact science, it's a trade-off between sensitivity of the data and the cost of protecting it whether you like it or not
Punishment isn't an exact science either, and there will be some arbitrary decisions that will be taken in order to find a trade-off between visibility and responsibility, whether you like it or not
Please-please, put it online for us to enjoy!
This will be bigger than the Panama Papers!
>This will be bigger than the Panama Papers!
why?
this particular leak is pretty mundane information for a relatively low number of people. its not even the biggest leak out of france this year.
It is already. You can buy it online. There is not a lot of places where hackers sell that kind of stuffs.
1k lines are already shared, seems legit. Most of them is just <30k€ people. Only a handful of millionaires (8 >10M if I remember correctly), 0 billionaires. 2/3 people, 1/3 pro, there is no information about tax of professionals.
Seems to be an API endpoint about people who ask questions to the DGFiP.
france is living through its own programmed obsolescence and it is 100% due to boomer generation locking in the vote to favor themselves instead of france future. can you believe that during covid governement pushed to raise retirements pensions by the inflation but forced to lock wages not to do that. they did that ONLY because boomers have the majority vote in this country. they also did the covid lockin for boomers, sacrifying all the youth generation to unemployement and debt.
France spends roughly 14% of its GDP on pensions for people that paid less than they now earning - literaly stealing money to young generations- , making pensions one of the country's largest public expenditures. The pension burden also appears inside the headline budgets of individual ministries: in 2026, about €25bn of the €90bn Education budget (~28%), €9.5bn of the €66.5bn Defence budget (~14%), €8.2bn of the €25.8bn Security/Police-Gendarmerie budget (~32%), and €2.4bn of the €13bn Justice budget (~18%) correspond to pension contributions.
So when France says it spends €90bn on schools, for example, only about €65bn is spending excluding the State pension contribution.
how is it related to obsolescence ? well if you are paid shit, have the highest tax in the world to make wealthy old people, why work hard? right now if you want to be working for the gov as an IT sec engineer you will earn less than an average civil servant working 35hours a week that just requires 0-2 year of post grade studies and you will be on a temp contract. there is literaly no decent engineer that will accept such a job. now scale that to many fields in france and see why this once great country is doomed
We should only allow vote for people that contribute to society or at least give them a stronger x2 x3 vote factor.
Same for retirement funds in france younger generations pay for the older ones but it appears that boomers did not make enough children for growth/equilibrium and are now earning more pensions than their children will. the logical thing to do is to decrease pensions for every boomer that has less than 2 children.
Liberté, égalité pas, fraternité
yeah. their fraternité ends when they need to fairly contribute.
Census suffrage has been abolished about a century ago. There's a minor hack and you want to reinstate it.
> ... boomers ... boomers ...
Ah, just bigotry. I see.
what bigotry? they are stealing the money and future of every french child being born and you defend them insulting people showing you the facts of bigots.
Now do EES face and thumb scans.