French tax office hacked: are Moroccans abroad affected?
On 13 August 2026 the French tax authority confirmed an intrusion dating back to late June and the extraction of data on individuals and businesses. A hacker claims 678,438 records, a figure still unconfirmed. What matters for Moroccans abroad is not where they live, but whether they have a live file with the French tax office.
In short
On 13 August 2026 the French Ministry of the Economy confirmed that an illegitimate access to the information system of the Direction générale des Finances publiques (DGFiP), the French tax authority, took place in late June 2026 following an identity spoofing. According to the official statement, that access allowed "the consultation and extraction of data concerning individuals and businesses".
The day before, on 12 August, a hacker using the alias ZeroBytes had claimed 678,438 records on a specialist forum. The DGFiP has confirmed neither that figure nor the exact list of data actually taken. Its investigation continues with ANSSI, the French national cybersecurity agency.
For a Moroccan living abroad, the right question is neither nationality nor country of residence. It is whether a live file exists with the French tax administration. A flat in Lyon, rental income declared in France, an old resident tax file: any of these is enough to appear in DGFiP records.
What is confirmed, and what is not
This is the most important distinction in the case, and the one most headlines flatten.
| Item | Status on 14 August 2026 |
|---|---|
| An illegitimate access occurred in late June 2026 | Confirmed by the Ministry of the Economy |
| The access followed an identity spoofing | Confirmed |
| Data was consulted and extracted | Confirmed |
| It concerns individuals and businesses | Confirmed |
| The access was interrupted in late June | Confirmed |
| 678,438 records | Claimed by the hacker, unconfirmed |
| The detailed list of fields in the file | Claimed, unconfirmed |
| The final number of people affected | Still being established |
The ministry states that "in-depth investigations are continuing in order to determine precisely the data and the number of users concerned".
In other words: the intrusion and the extraction are no longer a hypothesis, they are acknowledged. The scale is not yet established.
What the claimed file is said to contain
The file circulated on 12 August was analysed by the FrenchBreaches platform. According to that analysis, each record would include:
- •birth name, used name and given names
- •date and place of birth
- •tax address and mailing address
- •family situation
- •an identifier linked to the spouse
- •number of dependants and number of tax shares
- •reference tax income
- •withholding tax rate
- •phone number and email address
- •history of requests sent to the tax administration
No passwords appear among the fields listed.
A necessary caveat: this list comes from the hacker, not from the administration. It describes what he claims to hold. But it explains why specialists treat this leak as more serious than a leak of email addresses. A fraudster who knows your family situation, your number of tax shares and the history of your exchanges with the tax office no longer needs to be persuasive. He only needs to be accurate.
Can a Moroccan living in Morocco be affected?
Potentially yes, and this is the angle most French coverage does not address.
Being a Moroccan tax resident does not automatically place you outside the DGFiP's scope. A French file can remain active in several situations common among Moroccans abroad:
- •you own property in France, whether occupied, rented or empty
- •you receive rental income from a French source
- •you were a French tax resident in the past
- •you run a business or hold a company in France
- •an inheritance involving a French property is in progress
- •you have filed a claim or a request with the French tax office
- •you still hold a personal account on the French tax portal
In those cases, "I live in Morocco, so this does not concern me" does not hold.
The opposite is not true either. Nothing currently supports the claim that every Moroccan abroad with a French connection appears in the extracted data. The DGFiP states that affected users "will receive individual information specifying the data that may have been consulted or extracted". That notification is what counts.
This is not the first incident this year
This matters when answering the bank account question honestly, and the two cases must not be conflated.
On 18 February 2026 the same ministry published a statement on illegitimate access to FICOBA, the French national register of bank accounts. An individual had spoofed the credentials of a civil servant with inter-ministerial access, starting in late January 2026.
| FICOBA, February 2026 | DGFiP, August 2026 | |
|---|---|---|
| Accounts or records | About 1.2 million bank accounts | 678,438 records claimed, unconfirmed |
| Data cited | Bank details (RIB and IBAN), account holder identity, address | Data on individuals and businesses, detail not published |
| Tax identifier | Not consulted, per the statement | Claimed by the hacker |
| Status | Officially confirmed and quantified | Confirmed in principle, scale pending |
Two separate cases, two separate statements. Mixing them manufactures rumours.
What this changes for a Moroccan abroad who kept a French bank account: on FICOBA, bank details were indeed exposed in February. That does not mean an account can be emptied with an IBAN alone, but it does justify monitoring transactions rather than treating the matter as theoretical.
The real risk is not the one people picture
The first reaction to a tax data leak is usually to think about the bank account. That is not the most likely scenario.
The immediate risk is a calibrated fraudulent message. Not the crude, misspelled spam, but a message carrying your real name, your real address, your family situation and a reference to a step you actually took.
The chain runs like this: the data builds a profile, the profile produces a credible message, the message leads to a fake site, the fake site captures a password or a verification code, and the real account falls.
The CNIL, France's data protection authority, notes that a data leak facilitates precisely this kind of phishing and identity theft, and advises against clicking links in messages whose origin is not certain.
One point deserves to be stated plainly, because it saves people: the fact that a caller knows your personal information proves nothing. Not your tax number, not your address, not the amount on your last assessment. After a leak, those details circulate. They are no longer proof of identity, they have become a sales argument for the fraudster.
What the DGFiP says it never asks for
It is written plainly on impots.gouv.fr, and it is worth more than any list of tips:
"Your bank card number is never requested for the payment of a tax or the refund of a tax credit."
The administration also advises never to communicate personal data by email or telephone, and above all not a bank card number, and not to click on links inside such messages, which may redirect to a fake site.
In practice, never send by email, text or phone: a password, a code received by text, a bank verification code, your tax portal credentials, your card number, or a copy of your ID to an unverified contact.
Who you actually deal with as a non-resident
This is the most useful information in this article, and the easiest to verify. Someone who knows which office actually handles their file spots a fake message instantly.
| Your situation | Competent office | Contact |
|---|---|---|
| Income tax as a non-resident | Individual Tax Department for Non-Residents (SIPNR) | 10 rue du Centre, TSA 10010, 93465 Noisy-le-Grand Cedex, France. Phone (+33)1 72 95 20 42, 9am to 4pm |
| Property tax, residence tax | The local tax office where the property is located, not the SIPNR | Contact details shown on your tax assessment |
That second line matters. The non-residents tax directorate does not handle local taxes. A message presenting itself as coming from the SIPNR about your property tax therefore does not match how the administration actually works.
When in doubt, the recommended approach is always the same: do not use the link or the phone number given in the message. Go through the official portal you type yourself, or use the contact details printed on a tax assessment you already hold.
What the CNIL recommends
The recommendations below are the CNIL's, not ours.
After a data leak or theft, the CNIL advises not to click links in suspicious messages, to change passwords reused across several services, and to enable two-factor authentication where available.
In case of identity theft, it recommends preserving evidence, filing a complaint quickly, alerting the organisations concerned including banks, and following the steps that limit the consequences.
One often overlooked point deserves emphasis: the email address used for administrative matters is the keystone. Whoever controls that inbox can often reset the passwords of other accounts. It is worth checking connected devices, automatic forwarding rules and account recovery options there.
Where to report a fraudulent message
The channels below are those listed by cybermalveillance.gouv.fr, the French public assistance scheme for cybercrime victims.
| Type of message | Where to report it |
|---|---|
| Fraudulent text message | 33 700, free of charge |
| Phishing email | Signal Spam, signal-spam.fr |
| Fraudulent website | Phishing Initiative, phishing-initiative.fr |
If information has already been handed over, cybermalveillance.gouv.fr advises contacting your bank immediately to block the account, changing the affected passwords and any reused elsewhere without delay, checking your accounts, and preserving evidence, in particular the message received.
The France Victimes scheme supports victims free of charge on 116 006, seven days a week from 9am to 7pm.
A warning about fake checkers
Since 13 August, the coverage of the case has itself become a fraud tool. Messages of the "check whether your tax data was hacked" type are circulating.
Never enter your name, tax number or date of birth on a site promising to tell you whether you appear in the file. The only channel announced by the administration is the individual notification it will send to affected users once its investigation is complete.
Frequently asked questions
Can a Moroccan living in Morocco be affected by the DGFiP leak?
Potentially yes. Country of residence does not settle it. What matters is whether a live file exists with the French tax administration: property, rental income, past tax residence, business activity or a pending request. The DGFiP has not yet identified who is affected.
Does the leak really concern 700,000 people?
Not officially. The figure of 678,438 records comes from the hacker, not the administration. The ministry says the number of users concerned is still being established. A hacker's claim is not confirmed data.
Was my reference tax income stolen?
It appears in the list of fields claimed by the hacker, but the DGFiP has not published the definitive list of data actually extracted. The reasonable stance is to treat it as possibly exposed without asserting it.
Can a hacker empty my bank account with this data?
The data described contains no banking password. The main risk is indirect: using the information to persuade you to hand over a code or a credential yourself. Note that a separate case, the FICOBA file in February 2026, is the one that exposed bank details.
How will I know if I am affected?
The DGFiP states that affected users will receive individual information specifying the data that may have been consulted or extracted. That notification is what to wait for, not a third-party checking site.
Should I change my tax portal password?
No password appears among the claimed fields. The CNIL nonetheless recommends, after any leak, changing passwords reused across services and enabling two-factor authentication.
I received a text message from the tax office, what should I do?
Do not click the link. The DGFiP states that a bank card number is never requested for a tax payment or a refund. The message can be reported to 33 700.
Who do non-residents contact?
The Individual Tax Department for Non-Residents, on (+33)1 72 95 20 42 from 9am to 4pm, or by post to Noisy-le-Grand. Local taxes such as property tax are handled instead by the tax office where the property is located.
What to take away
Neither "every Moroccan abroad is affected" nor "I live in Morocco so I am safe". Both are wrong.
The accurate reading fits in one sentence: if you have a tax, property or business connection with France, assume your data may be circulating, treat any unsolicited tax message as suspect however accurate it looks, and wait for the official DGFiP notification to know whether your file is concerned.
This article will be updated as the administration clarifies the scale of the leak.
Sources
- •French Ministry of the Economy, statement of 13 August 2026, illegitimate access to the DGFiP information system: https://presse.economie.gouv.fr/?p=182374
- •French Ministry of the Economy, statement of 18 February 2026, illegitimate access to the FICOBA file: https://presse.economie.gouv.fr/?p=171314
- •impots.gouv.fr, fraudulent emails and text messages: https://www.impots.gouv.fr/courriels-et-sms-frauduleux-hameconnage-ou-phishing
- •impots.gouv.fr, whom to contact if you are a non-resident: https://www.impots.gouv.fr/particulier/questions/qui-sadresser-si-je-suis-non-resident
- •CNIL, what to do after a data leak or theft: https://www.cnil.fr/fr/conseils-fuite-vol-donnees
- •CNIL, how to react to identity theft: https://www.cnil.fr/fr/comment-reagir-face-une-usurpation-didentite
- •CNIL, data leaks and IBAN theft: https://www.cnil.fr/fr/fuite-de-donnees-sur-internet-et-vol-de-votre-iban-comment-vous-proteger-si-vous-etes-concerne
- •cybermalveillance.gouv.fr, phishing: https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/hameconnage-phishing
Related articles
Related practical guides
Are you an MRE?
Join the platform and reach verified professionals in Morocco. Free.
Have a project in Morocco?
Find a LesMRE-verified expert to guide you through your steps.
Find an expert →