🔴 The French Tax Authority Hack: How Did We Get Here?

In the middle of the summer break, we all learned of a major incident at the heart of the state. We had already discussed the question of state security when the ANTS, the agency that issues ID documents, was hacked, but this time, it has to be said, we have reached a new level, perhaps the highest ever reached.

And always the same question: how is this possible?

To confront different points of view, I talked with members of our community from a range of backgrounds: a specialist in the digital transformation of the state, a cybersecurity specialist, a political figure and a few old hands of the digital world. A nuanced analysis that tries to go a little further than the ambient noise.

The facts first

The DGFiP (the French tax administration) has confirmed an intrusion that led to the leak of a file of 678,000 entries, individuals and businesses. The director general of public finances, Amélie Verdier, confirmed the tally and the main categories of data concerned on the evening of Friday, August 14: first and last names, family quotient, reference taxable income and withholding tax rate. The sample analyzed by FrenchBreaches from the data claimed by the hacker also contains the address, phone number, email address and number of dependents.

Timeline

The attacker's access had been cut off at the end of June, but the exfiltration had not been detected at the time. The leak was only identified after the data was put up for sale, on August 12. That alone is already a large part of the problem.

Since then, everything has accelerated

The same hacker has claimed a second attack, carried out at the end of July against the professional server for cadastral data and confirmed by the administration: more than two million people affected, by his account. He also gave his version of events, access obtained through a VPN used by tax agents, and allowed himself a comment: people, he says, need to wake up and see just how much “France is a joke.”

And the political class is weighing in: MEP Aurore Lalucq, co-president of Place publique, called on X for the resignation of the minister in charge of public accounts, David Amiel, after denouncing that the intruder “walked in and walked out with the register. Enough is enough.”

The Education Ministry hack

And meanwhile, another administration also got hacked in complete obscurity.

On the night of July 25 to 26, someone got into the information system dedicated to training Education Ministry staff. Same thing as at the DGFiP: a hijacked professional account.

The data concerned is that of every employee who has worked in a regional education authority since 2001: identity, status, duties, and for some of them postal address, phone number and social security number. To our knowledge, the ministry has not published any figures on the volume. The press release came out on July 31, in the middle of the summer holidays, and nobody talked about it. It was the third hack of the Education Ministry since January.

The Bulgarian example

Many people on Twitter asked the question: can you sue the state for negligence?

The answer comes from Bulgaria. On July 15, 2019, the Bulgarian National Revenue Agency was hacked. The tax and social security data of six million people ended up online.

A taxpayer sued her administration. The Court of Justice of the European Union ruled on December 14, 2023 and confirmed three things.

• The fear that one's data might be misused is enough to constitute compensable harm, without having been the victim of anything at all.
• The burden of proof is reversed: it is up to the administration to prove that its security measures were appropriate.
• And the fact that the harm was caused by hackers does not automatically exonerate the administration.

The ruling of the Court of Justice of the European Union interprets the GDPR, so it applies in France too.

Putting computing back at the center

To understand, we also need to put computing back at the center of the discussion. Over the past few years, cybersecurity has turned into a hodgepodge of regulation, governance and communication, relegating the question of technological know-how to the background. It's sad.

I don't consider myself a cybersecurity specialist, but I was immersed very young in the computer underground of the 80s and 90s, the one of the Chaos Computer Club and Kevin Mitnick, and I sometimes get the feeling that nothing has changed since.

On one side there are the people who do the work of securing systems, who have a practical technological sense, and on the other the people who talk about these subjects without really knowing how things work. That said, I understand the frustration of the many specialists who predicted everything that is happening today.

But as we will see, there is also a significant bias in the world of computer security, where the Unix computing of the 1990s and 2000s and the security models inherent to it dominate. This is particularly the case at ANSSI (France's national cybersecurity agency) and in many government departments. With the arrival of the cloud and now AI, putting security strategies in place means working with more and more non-technical players, and sometimes with the political world, which prefers PR to substance. It can't always be easy to juggle the directives, even if that does not excuse the backlog accumulated on these issues.

It is in this context that we need to look at the tax authority hack today. The aim of this newsletter is not to write an accusatory piece (hard to do with only fragmentary information), but to offer a first analysis of dysfunctions that are partly, and I do mean partly, understandable.

One thing must be said right away, because everything else follows from it. The problem is not that an attacker can get into a system, that will always happen. The problem is that a compromise takes this long to be detected and gives access to far too much. Especially since Bercy, the Finance Ministry, had already suffered another cyberattack a few weeks earlier.

Imagine someone forces the door of your shop, you don't check whether anything was stolen, you don't install an extra alarm, and you get burgled again.

Three questions immediately come to mind:

• Why does this type of attack seem to keep repeating?
• How can an attacker who manages to get into a government service walk away with the data?
• Why do the exfiltration and the consequences for users seem to be detected and communicated so late?

These three questions open up two others, far deeper:

• Is the problem technical or organizational?
• And how do yesterday's turn toward the cloud, and today's turn toward AI, accelerate the inadequacy of the state's cyber policy?

Normally, the rest is reserved for our paying subscribers. Exceptionally, given the subject, I have decided to open this newsletter to the public, but the proposals, all the sources and the bonuses remain reserved for paying subscribers.

In three years, readers of this newsletter have become the go-to people on tech, geopolitics, cyber and AI in their organizations. Become a member of our community. Subscribe.

⸻

1. Why does this type of attack seem to keep repeating?

The starting point is obviously the “pattern” found in almost every recent incident: an access is compromised, the attacker gets into a sensitive system, reaches valuable data and can then exfiltrate it, before announcing its resale on the darknet.

The very many attacks France has suffered are not necessarily identical, but they demonstrate a systemic problem: an initial compromise produces very serious risks and consequences. And they force us to ask a very worrying question. If the hacker had not announced the sale of the data, would the government have known? Does this mean there may have been large-scale hacks we know nothing about?

A never-ending hack

This repetition, moreover, is no longer an impression. The same hacker has claimed a second attack, at the end of July, against the DGFiP's professional server for cadastral data, confirmed on Friday evening by the administration.

The hacker claims 252,149 rows extracted, representing by his account more than two million people: identity, date and place of birth, address, property identifier, parcels. He claims to have bypassed multi-factor authentication, the mechanism that requires a second verification on top of the password, and estimates at 20 million the number of citizens present in this system.

Two claimed attacks on the same administration, the same summer.

A quick reminder. In 2026 alone: 774,000 students at CNOUS (the national student services agency) in March, two million according to the hackers; 1.5 million people at the Secretariat-General for Catholic Education; 243,000 Education Ministry employees, before the ministry's two other intrusions; an ÉduConnect leak affecting pupils revealed in mid-April. A senator on X called it France Passoire, France the sieve.

When you look more closely, you realize that these recent incidents do not necessarily rest on the same technical scenario.

That sharpens the question further. It is not why someone can get into a system: a password, a VPN access and a privileged account (the ones with access to everything) can always be stolen. The question is why, once inside the system, you can walk out “with the register,” as MEP Aurore Lalucq put it.

To answer that, let's take an image from the movies.

In action movies, we often see the hero cut the fence around a factory, slip past the armed guards and swipe a badge to get inside. There, without being noticed, he goes to the room where the secret plans are kept and manages to get out. Once inside, there is no other security, because normally nobody is supposed to be inside. That's a bit what happens with government services: once you're in, it's pretty much the jackpot.

To understand why, we need to go back over a bit of history.

The historical model of physical barriers

A first explanation comes from the state's historical security model. Many systems were designed in an environment where computer access was preceded by a series of physical barriers: a secure building, a badge, a controlled machine, an internal network.

This logic naturally leads to granting more trust to someone once they are “inside.”

It is the exact opposite of zero trust, the principle of trusting no access by default and re-verifying everything continuously, at every action. But zero trust assumes a modern architecture. Nothing prevents applying these principles to an old system, but it means overhauling it in depth. Otherwise the system inherits the security properties of the era that gave birth to it: once in, you have access to everything.

This system has advantages, but it is only effective when the people are known.

Covid and remote access

Covid brutally changed this model. Remote work and VPNs made it possible to reach, from the outside, systems originally designed to operate in a much more closed environment. Obviously, it was essential to avoid paralyzing the state, but as many experts have been telling me for a long time, access was extended without necessarily rebuilding everywhere the trust model on which the systems rested. And above all, since Covid, updates have been nowhere to be found.

There is also a psychological aspect we were slow to perceive: when working remotely, the organizational lens that makes you understand that what you are handling is sensitive dissolves. And newcomers, those who arrived directly into this hybrid environment, don't necessarily have the same security reflexes.

But that's not all.

When interministerial access sows discord

Many government IT systems are designed first and foremost for their own users. You define the security policy, you know the people, the machines and your network. But sometimes you have to give access to outside users or systems whose security conditions you don't fully control.

The Ficoba hack (the national register of bank accounts) seems to be the textbook example: the compromised access belonged precisely to a civil servant authorized to consult the file as part of interministerial exchanges. It is said that this is the case for other attacks, but in the absence of sourced data (see the end of this document) that remains a hypothesis.

These interministerial accesses pose challenges both for the security policy and for how incidents are handled.

Patches handled locally

The apparent repetition of hacks also comes from the fact that incidents are often handled at the level of the ministry concerned.

Fixes are indeed made after each attack, password rotations, hardening, but they do not automatically produce a cross-cutting re-examination of all the systems that share the same dependencies: remote access, privileged accounts, relationships between administrations, rights management or exfiltration detection.

Different incidents have therefore probably revealed common weaknesses in the way the state controls, overall, identities, access and the consequences of a compromise.

The special case of the tax authority

The tax system, for its part, piles up the peculiarities. It is one of the oldest systems in the state, eminently legacy, heavily siloed, hyper-processed, hyper-controlled. It is the state's cash machine, and for a long time it was considered the exemplary service, electronic tax filing being broadly a success and the people who work or have worked there being well regarded by their peers.

It is also deliberately set apart: it was considered risky to pool it with the rest, given the sensitivity of the mission. This segregation has its security virtues, but it places the system outside the shared platforms and their rules.

Finally, it is deeply seasonal: there is the filing rush with its share of constraints, it's a bit like Amazon's Black Friday for the state, followed by a holiday period.

The intrusion at the end of June took place right in the post-rush period, which surely made it even harder to detect.

2. How can someone get in and walk out with the data?

The first barrier is authentication, but it cannot be the last.

If we start from the principle that an identity can always be compromised, the system must continue to control what the user does once logged in. And that is where the shoe pinches.

A former ministerial adviser told me a few years ago: sometimes it feels like the state is one giant OneDrive, once you're in, you more or less have access to everything.

I wonder whether he wasn't a little bit right.

In digital services on Unix (which is the reference), there has always been a distinction between the right to log in, the right to view a piece of data, the right to view a lot of it at once, and even the right to copy it and the right to export it.

Fine-grained rights management has existed since the prehistory of the Internet; modern systems add logging, anomaly detection, re-authentication and additional controls on sensitive operations.

ANSSI itself, moreover, presents logging as an indispensable building block of security: it makes it possible both to detect incidents and to reconstruct, after the fact, the path of an attack and its impact, which is hugely important.

Privileged accounts

Privileged accounts are a particularly critical point. An administrator, a technical or functional account can have far broader rights than a normal user; its compromise immediately turns an identity problem into a problem of potentially massive access to data.

In WarGames (1983), they were already explaining what a backdoor was, and the film explains the risk of using a privileged account.

Exfiltration is another step

Exfiltration is then a different step from access. Even if an attacker manages to get in and view data, an unusual volume, a massive download or an export should be able to trigger an alert, a limitation or an additional validation.

That is precisely what makes the current case significant: the DGFiP says it detected and cut off the access at the end of June, without having detected at that point that data had been exfiltrated.

Since the hacker's claim, the DGFiP has specified that the impots.gouv.fr site and the user accounts, individuals and businesses alike, were not compromised, and says it cut off, as soon as it detected the intrusion, access for all the accounts used in the identified incidents, as well as other sensitive applications as a precaution.

Three possible explanations

You have to understand how detection works on this kind of system. The trigger is based on the volume of data, not on access to the data. Anyone who knows there is a threshold beyond which they will be spotted only has to stay below it and extract in small quantities.

From there, there are only three possible explanations for an undetected exfiltration.

• Either the extraction is not logged anywhere, and that is an intolerable design flaw on a system of this sensitivity.
• Or the attacker got in, obtained enough privileges and erased his tracks behind him.
• Or nobody bothered to check how he had operated.

None of these three options is reassuring, but let's wait for the Retex, the after-action review, if it is made public, which I don't think the administration will do, for obvious reasons.

But let's return to the comparison with data exports from Facebook or LinkedIn. Some mechanisms have become ordinary: recognizing a new device or a new browser, flagging certain unusual logins, strengthening authentication and framing export procedures. If these measures were not implemented, it would strengthen those who say that, on cybersecurity, it is sometimes better to trust Big Tech than the state.

And yet, the big platforms are not necessarily immune. A quick reminder.

October 2015. John Brennan, director of the CIA, has his personal AOL account hacked by teenagers. They call his phone carrier, pass themselves off as a technician, obtain his details and reset his password. The security clearance questionnaire he had filled out for the CIA, some fifty pages containing his background, his addresses and the contact details of his relatives, was sitting in that mailbox. It gets published.

March 2016. John Podesta, Hillary Clinton's campaign chairman, has his Gmail account hacked following a fake Google security alert. He clicks the link and enters his password on a fake login page.

October 2016. His emails are published by WikiLeaks during the last month of the campaign.

January 2017. US intelligence attributes the operation to Russia, to the APT28 group.

Spring 2017. The same group targets Emmanuel Macron's campaign. Five waves of phishing target his staff, with fake web pages and a fake server imitating the team's internal tools. On May 5, two days before the second round, nine gigabytes of campaign documents are published online.

2017. Google requires its 85,000 employees to use a physical security key, a phishing-resistant second factor, and launches an advanced protection program for journalists, activists, campaign teams, executives and administrators. In this program, the key is required at every login on a new device, and it disables both SMS codes and the authenticator app.

July 2018. Google announces that none of its 85,000 employees has fallen victim to phishing since, and that no account takeover has been observed. Price of the key: twenty dollars.

August 2018. Google starts selling its own key, the Titan, sold at $50 a pair in the United States, one USB-NFC key and one Bluetooth key.

January 2019. Researcher Troy Hunt discovers a file of 772 million email addresses and 22 million passwords, resold by a hacker for less than €50. Emmanuel Macron's Gmail address is in it, with his password, in a sub-file shared on June 25, 2017. It is the personal address he still uses at the Élysée. The Élysée tells the Journal du dimanche that the password is changed regularly and that two-factor authentication by phone code has been enabled, the method Google had taken away from its employees two years earlier.

But let's move on to the third question.

3. Why was the leak discovered and communicated so late?

We need to distinguish three moments: the intrusion, the exfiltration and the discovery of the exfiltration.

An administration can identify an abnormal access, cut it off and start an investigation without immediately knowing that data has already left the system. According to public statements, the DGFiP detected the access and cut it off at the end of June, but says it did not identify the exfiltration. It only discovered the leak after the data was publicly put up for sale, on August 12.

That answers a first question: the delay in communication does not necessarily reflect a decision to hide a known leak. In any case, let's be clear, it is very hard to imagine the head of a central government department not reporting an intrusion to the CNIL (the French data protection authority). The people who run the state follow the state's rules.

The other underlying question remains: the administration had not seen that data had already gotten out. If this hypothesis is correct, the central issue becomes the system's capacity for observation. You have to be able to reconstruct precisely what happened: which account acted, which data was viewed, which was copied, when and in what volume.

The 72-hour rule

The 72-hour question must be treated with the same precision. The GDPR does not start this clock from the date of the intrusion, but from the moment the data controller becomes aware of a personal data breach.

The exact timeline of detection is therefore essential to know from what point the notification obligation applied.

This 72-hour deadline, incidentally, has a twin that nobody mentions. Since Article 5 of the law of January 24, 2023, a legal entity or a professional that falls victim to an attack on an automated data processing system must file a complaint within 72 hours of becoming aware of the attack, failing which its insurer does not pay out.

Two obligations, two recipients, and the same starting point: the moment you understand what happened. This mechanism does not apply to the state. It does not take out cyber insurance, it is its own insurer, and so the penalty has no hold on it.

The government's bug

While the entire state keeps getting hacked, the main digital protection law, the transposition of the NIS2 directive, still has not been passed. This 2022 European directive imposes on some 15,000 French entities, companies and administrations, a common security baseline: risk management, incident notification, with penalties to back it up. It was supposed to be transposed before October 2024.

The French timeline leaves you speechless.

• Presented to the Council of Ministers in October 2024.
• Adopted by the Senate in March 2025.
• Examined in committee at the National Assembly until September 2025.

Then nothing. The text never reached the floor, it was not even placed on the agenda of last July's extraordinary session. Examination is now announced for September 2026.

Since then, the minister delegate for Artificial Intelligence and Digital Affairs, Anne Le Hénanff, has been inaudible. Yet she was the rapporteur of this Resilience law at the National Assembly before joining the government in October 2025. Nobody is supposed to know the text better, and it still has not been scheduled.

The reason for this blockage is now known. On February 4, 2026, at a press conference in the Senate, the two chairs of the special committees responsible for examining the text, deputy Philippe Latombe and senator Olivier Cadic, pointed to the executive, and behind it the DGSI (domestic intelligence).

The sticking point comes down to one article, 16 bis, introduced by Olivier Cadic and already passed by the Senate. It prohibits the state from imposing backdoors on encryption providers.

• According to deputy Philippe Latombe, the DGSI does not want the regulation transposed as it stands.
• For senator Cadic, the reason for this amendment comes from what happened in the United States, where backdoors installed to monitor calls and messages were exploited by Chinese hackers, compromising millions of communications.

This is the famous Salt Typhoon affair.

Meredith Whittaker, president of Signal, detailed its consequences on stage at DLD in January 2025.

The attackers obtained minute-by-minute location data and account-level information on millions of people living in the United States.

They hacked Trump's phone, and Vance's.

They mapped people entering and leaving buildings, including the CIA complex in Washington, linking them to identified accounts.

They also had the call records, who calls whom, at what time, for how long and how often.

All of it obtained through the very backdoors that law enforcement had imposed on carriers so that, in Whittaker's phrase, the good guys could get in. The backdoor the state wants to reserve for itself ends up turning against it.

On NIS2, Europe is no longer waiting.

Twenty-three member states had missed the October 2024 deadline; nineteen have since come into compliance. Only four laggards remain. On July 8, 2026, the Commission referred France to the Court of Justice of the European Union, along with Ireland, Spain and the Netherlands, requesting a lump sum and daily penalty payments. France is also the subject of a second referral, since April 2026, over the CER directive on the resilience of critical entities.

To return to the tax question, it is interesting to see that the Solidaires Finances Publiques union says it wrote to the director general as early as June, after the Tchap and France Services leaks, to flag risks of hacking, identity theft or targeted phishing “in the very short term.” The union now denounces a belated communication.

Now we need to analyze the consequences of all this.

Managing the consequences

This data is not supposed to get out. For a foreign service's OSINT, open-source intelligence gathering, such a file is a gold mine. States, and of course organized crime: spotting people with money in order to burgle or extort them. According to the analysis of the data claimed by the hacker, 26,805 of the individuals concerned would be declaring a reference taxable income above €100,000, and 386 would be above one million.

Cross-referencing with the cadastral data from the second attack, identity, address, real estate holdings, further increases the value of these files for targeting.

The precedent of the French Shooting Federation

This scenario is not theoretical, it has already happened. In October 2025, the French Shooting Federation had the data of nearly one million current and former license holders stolen: civil status, postal address, phone number, license number.

In the following months, individuals showed up at license holders' homes passing themselves off as police officers or gendarmes, sometimes in uniform, to have weapons handed over to them. Thefts were recorded in Nice, Paris, Limoges and Décines.

Before the National Assembly, the Interior Minister acknowledged that between twenty and thirty incidents could be directly linked to this hack. The federation, for its part, links these burglaries to data resold on the darknet.

And that leads to the question that should keep people up at night. If the only thing that allowed this exfiltration to be discovered is that the hacker decided to claim it publicly, then how many extractions have been carried out by people who, for their part, announced nothing? Could someone gather enough data from multiple services to create a realistic simulation of France?

Nobody can answer. That is precisely the problem.

Two other questions remain open.

4. Is the problem technical and organizational?

For many of the people I spoke with, it all starts with the state reform program Action publique 2022, launched in October 2017, whose digital component aimed for 100% of administrative procedures to be online by 2022.

The objective was essentially met. In five years, the relationship between the French and their administration moved online. But the state's digital footprint has probably grown much faster than the organizations responsible for maintaining it.

Technical power and decisions

The issue has never been a lack of competent people in the state. The problem is that the people who really understand the systems are not necessarily the ones with the power to impose architectures, security rules or the halt of a project deemed dangerous.

In the context of the current attack, Bercy's unions themselves have pointed to the lack of resources, the difficulty of recruiting digital professionals and the need for additional investment.

Three shortfalls

If we had to make a first diagnosis, there are mainly three shortfalls:

• a lack of resources
• a lack of practical sense
• a lack of expertise in leadership positions.

We went too fast and we put a lot of improvisers in power. (a former political official)

But as a friend said, there is also the famous Conway's law: systems tend to mirror the structure of the organizations that produce them.

Within the state, ministries remain responsible for their information systems, while DINUM, the government's interministerial digital directorate, provides interministerial coordination and pooling functions.

Two opposite examples show it.

At the Ministry of the Armed Forces, authentication is central, the whole is governed, under control.

At the Interior Ministry, it's federations of federations, bunches of grapes: a prefecture has its autonomy, the legitimacy to think things through differently in its own corner, and a centralized system there would be experienced as antidemocratic.

Decentralization is not a problem in itself. It becomes one when it prevents applying a common level of security to systems that nevertheless have to connect to and trust one another.

You can then have systems that are properly protected locally but weakened by their dependencies. An administration cannot be fully resilient if its level of security depends on another system whose accounts, access and rules it controls none of.

That raises a crucial question, incidentally.

Is the tax authority still a third party you can trust?

The loss of trust in the tax system could have a significant side effect. The impots.gouv.fr account is itself an identity provider for FranceConnect: it therefore allows you to authenticate with other public services.

The DGFiP says that user accounts, individuals and businesses alike, were not compromised. But the principle stands: if an identity provider is perceived as attackable, it's the chain of trust that wobbles, as with the ANTS. A bit as if Facebook Connect were corrupted.

The digital transformation has heightened this tension. More services, more data, more remote access and more interconnections have created a common attack surface, while responsibilities and architectures remain largely distributed. This will remain the dark spot of the Macron decade. A lot for startups, not enough for the state's own digital infrastructure.

And above all, a glaring lack of vision.

⸻

5. The cloud, the first turn taken badly

The cloud was a first profound change of model. It was not simply a matter of moving servers, but of thinking in terms of distributed systems, multiple identities, remote access and a security that no longer rests primarily on a physical or network perimeter.

The state's cloud doctrine

The state has had a cloud doctrine for several years: a first strategy appeared in 2018, and “Cloud au centre” made the cloud the default hosting mode for new projects starting in 2021.

But in March 2026, DINUM was still presenting the migration of the large historical and sensitive information systems to the “trusted cloud” as a new stage of the transition.

The problem, then, is not that the state ignored the existence of the cloud. It is that the transformation of its legacy systems and of its organization remains incomplete, even as distributed uses have become widespread.

As we have seen, Covid brutally accelerated this contradiction: remote access and remote work had to be rolled out on a large scale before all the systems and all the organizations were ready to operate in this new model.

In the age of digital sovereignty as totem, an audit of the state's failed platformization will be indispensable.

⸻

6. AI, the next turn

AI is a second change of the same magnitude as the cloud. It directly changes the means available to find and exploit existing weaknesses: automation, faster analysis of systems, exploration of several vectors and a reduction in the human cost of certain offensive operations.

This change is no longer theoretical. The NCSC, the UK's cybersecurity agency, anticipates an increase in AI-assisted exploitation of vulnerabilities and a shorter window between discovery and exploitation.

The AI Security Institute, the UK public body responsible for evaluating AI models, is measuring rapid progress by models on cybersecurity tasks, while Anthropic is already documenting real cyber operations using AI.

A subject put off until later in France

The problem is that this development has been known for several years but is still often treated as a future or secondary subject. The risk is reproducing the same lag as with the cloud: understanding the change, but adapting the systems only when it becomes impossible to do otherwise.

A doctrine of delay

This lag is found in black and white in official documents. In its threat assessment devoted to generative AI, published on February 4, 2026, ANSSI stated that it was “not aware of any cyberattacks carried out against French actors using artificial intelligence,” nor had it identified any AI system capable of carrying out all the steps of an attack on its own, while deeming it plausible that these technologies would improve the level, quantity and effectiveness of attacks, particularly in poorly secured environments.

The Panorama de la cybermenace published this spring mentions attackers' interest in AI “without it being relevant, however, to speak of a paradigm shift.”

Yet these texts came out less than three months after Anthropic's report documenting the first espionage campaign largely orchestrated by an AI, and at the very moment the British agencies were describing, with figures to back it up, the acceleration of offensive capabilities.

At the same time, the agency's public communication remains centered on prevention: a 2026-2030 strategy that makes raising awareness among the general public a priority, on the model of road safety, and alerts reminding senior civil servants of the basic rules of digital hygiene.

These messages are necessary. But set side by side with what the British agencies and the AI labs document, they outline a gap between a threat whose means are changing in scale and a public discourse that has not yet absorbed this change.

The premise of out-of-reach resources

The implicit doctrine rests, moreover, on a premise: serious incidents would be reserved for attackers with resources out of reach, state or quasi-state actors. Many of us think that is no longer the case.

The hacker claiming the tax authority attack also says he is reselling databases stolen from SFR, Intermarché, the French Handball Federation and Accor. The press describes young profiles, motivated by notoriety and money, not computer geniuses. The suspect indicted after the ANTS hack is fifteen years old.

Questioned by FrenchBreaches, the hacker describes a purely opportunistic activity: spot a flaw, access whatever is available, resell, because everything sells.

The asymmetry between attack and defense

Defending costs infinitely more than attacking. The defender has to protect all his systems, all his accounts and all his connections, permanently. The attacker only needs to find a single door, once.

The whole question is what AI changes in this balance of power.

The AI labs answer that it will benefit both sides. It will help the attacker find flaws faster, but it will help the defender just as much to spot and fix them.

One of the specialists in state systems security I spoke with doesn't believe it for a second.

For him, we will never catch up with offense using AI applied to defense. Speeding up both sides at the same rate doesn't reset the counters: the defender goes faster on a job that never ends, the attacker goes faster on a job that stops as soon as he has found his door. The gap doesn't close, it widens. I completely agree with him.

The cybersecurity agencies, for their part, don't take a position, because they no longer have the big picture. They document the acceleration of offensive capabilities, while recalling that AI can also strengthen defense. But they don't have access to the labs' frontier research.

And above all, they are preparing for an American change of doctrine that few people dare to document publicly.

The American pivot

The United States is dropping Europe, and France in particular. This is no longer an analyst's worry, it's a sequence of decisions.

The mechanism is simple. They keep offensive power for themselves and hand it to the private sector, and they withdraw from everything that collectively protected Europeans. The forums where methods, alerts and intelligence are shared are emptying out. The teams that countered information manipulation are closing. And when an ally tries to take over, it gets blocked.

A quick reminder for those who haven't read our previous newsletters:

February 2025. CISA freezes its election protection activities and places the staff in charge of disinformation and foreign influence on administrative leave. Europeans lose the agency that tracked interference campaigns against elections.

April 2025. The State Department closes its office for countering foreign disinformation, the one that tracked Russian and Chinese influence operations. Europeans no longer have a counterpart in Washington on this subject, just as Russia steps up its hybrid operations in Europe.

July 2025. The budget law, the One Big Beautiful Bill, allocates one billion dollars to the offensive cyber operations of Indo-Pacific Command through 2029, and 250 million to Cyber Command's AI work. The same law cuts around $1.2 billion from civilian cyber defense budgets. Attack is funded by cutting defense.

December 2025. Jamie Tarabay reveals, in an exceptional Bloomberg investigation, that the administration is preparing a strategy to entrust private companies with conducting offensive attacks against foreign adversaries. Offense leaves the state's perimeter, and the parliamentary oversight that came with it.

January 7, 2026. A presidential memorandum orders withdrawal from the Global Forum on Cyber Expertise, the Freedom Online Coalition and the European Centre of Excellence for Countering Hybrid Threats in Helsinki, where the United States had sat since 2017 as a founding member. These are the three forums where alerts and methods circulated.

January 2026. Around two hundred American positions are eliminated within NATO structures, and American participation reduced in some thirty Alliance bodies, centers of excellence included. With these people go the shared procedures and the intelligence that circulated with them.

March 2026. The national cybersecurity strategy runs to four pages, against nearly forty in 2023. It calls for unleashing the private sector to identify and disrupt adversary networks. The objective is no longer to defend a common space, but to know how to hit harder.

July 2026. Washington blocks, within the Alliance, the French project for a NATO center of excellence on military AI in Rennes. Paris decides to move forward without American approval. This standoff could deprive the Rennes center of the Alliance's status, network and formal integration.

August 12, 2026. A program authorizes accredited private companies to conduct, under federal control, surveillance operations and cyber-effects operations that can go as far as destroying foreign systems. What Tarabay had announced eight months earlier. Commercial companies can now disrupt, degrade or destroy systems abroad.

In eighteen months, the landscape has changed. I had tried to talk about it at various cyber conferences; I was told that agentic AI was for 2027 (sic).

The center of gravity of open AI, moreover, has left California for China.

According to the Hugging Face report, Chinese models now account for 41% of downloads over twelve months, ahead of American models. And Alibaba's Qwen model is the parent of 69% of new derivative models in February 2026, against 1% two years earlier.

This is going to have dizzying implications. To protect France's digital heritage, we are more likely to use a model trained in Hangzhou than a French model. Mistral, for that matter, has ended the suspense and is preparing to become a Chinese inference workload for European players. It's a smart move, but also an admission that we should have bet on these models earlier.

In less than a year, the options are now limited for cybersecurity, and possibly for cyberattack:

• closed American models, access to which depends on lists kept by private companies whose constraints are going to get tighter and tighter;
• or open Chinese models, powerful and free, developed in a country pursuing its own objectives.

France finds itself in the position of a middling country. Good engineers, good centers, and no capacity of its own to produce the tools that make the difference. Where France has the nuclear deterrent that makes it credible, we have no frontier AI deterrent.

In early August, at Black Hat, two OpenAI engineers recounted how their autonomous agents had organized themselves to get into Hugging Face, setting up a forum among themselves where they swapped the vulnerabilities they found.

A year earlier, at DEF CON, seven autonomous systems had discovered 18 real flaws that nobody knew about, with a fix produced in 45 minutes on average, and their code was published: these tools now belong to everyone.

Meanwhile, the French strategy for 2026-2030 makes raising awareness among the general public its priority, on the model of road safety.

Conclusion

An identity always ends up compromised. What distinguishes a secure system from a fragile one is what happens next: how far the attacker can go, what he can copy, what he can get out, and how long it takes to notice. On these three points, the DGFiP failed, and it is not alone.

The protections exist, and so do the skills. What is missing is the power to impose them everywhere, on every administration, without waiting for each weakness to be discovered after an attack.

We missed the cloud turn, we are in the process of missing the AI turn, and the text that was supposed to protect us is still waiting to be voted on. Meanwhile, our ally is withdrawing and our tools come from elsewhere.

The tax authority hack is therefore not an isolated incident. It is the measure of what the state is still capable of holding.

Thank you for reading. For subscribers, a few extra bonuses.

If you're discovering us, consider subscribing now, because prices are going up.