Hacking the Tax Authority: When a Cyberattack Becomes a Matter of State

On August 14, 2026, the French tax administration acknowledged an intrusion into its systems. Within hours, the figure emerged: nearly 700,000 individuals and businesses were affected, according to the Direction générale des finances publiques (DGFiP). By the end of the day, Prime Minister Sébastien Lecornu had announced an interministerial crisis unit (CIC), and the Paris prosecutor's office had opened an investigation into fraudulent data extraction and criminal conspiracy. In three days, a technical incident had become a matter of state. And the question no one quite puts into words is the one the novel Dileviathan has been asking from the start: what remains of a state whose vital organs are exposed?

A Massive Attack, a Graduated Response

The facts sketch an operation of considerable scale. The intrusion gave attackers access to the data of 678,000 users — a figure the DGFiP communicated with caution. Taxpayers' online accounts were reportedly not compromised, but the exposed data is sensitive: civil status, addresses, income, bank details.

The executive's response follows a now well-worn doctrine: detect and interrupt, prosecute, inform, reinforce. A formal complaint was filed, the Commission nationale de l'informatique et des libertés (CNIL) was notified, and individual notification of victims was set to begin on August 17. Behind the communications, the CIC was tasked with preparing that notification and taking stock of the government's digital security plan launched on April 30, built around a new framework for the state's digital governance.

The Ghost in the Machine

This is where the novel illuminates the present. In Dileviathan, the chapter titled The Ghost in the Machine describes a state whose systems have become so interconnected that no one can say anymore where legitimate oversight ends and surveillance begins. The cyberattack on the DGFiP is a brutal materialization of that intuition: the tax administration, which centralizes everything the public authority knows about each of us, is at once the most powerful and the most exposed machine in the state.

Asma Mhalla, a political scientist specializing in digital affairs, analyzes this contradiction in her book Technopolitique : comment la technologie fait de nous des soldats. She describes infraSystems — those invisible infrastructures (clouds, networks, sensors) on which modern sovereignty rests. The French state is portrayed as a giant with fragile foundations: it has delegated part of its critical infrastructure to private operators, and finds itself dependent on systems it does not fully control.

Mhalla's thesis converges with the question the novel poses: technology makes soldiers of us, often without our knowing it. When the DGFiP is hacked, it is not merely 678,000 citizens who are exposed — it is a demonstration that the digital state is a fortress whose walls are made of cardboard.

The Political Question Follows Quickly

Socialist senators called for a parliamentary inquiry commission as early as Sunday. Their argument: the succession of recent incidents warrants an examination of whether common vulnerabilities exist across government agencies. It is a way of raising the question the executive prefers to avoid: why does the state, which centralizes the nation's most sensitive data, find itself regularly cast as a predictable victim?

Since attacks on local authorities, hospitals, and central government agencies began to multiply, France has created tools, agencies, and plans. The Agence nationale de la sécurité des systèmes d'information (ANSSI) intervenes, Viginum monitors foreign interference, and the April security plan was meant to set a course. Yet the DGFiP hack throws into relief the gap between political announcements and the reality of public information systems. As in the novel — where promises of transparency collide with the materiality of machines — the distance between discourse and infrastructure always exacts its price in the end.

Surveillance Capitalism and Resilience

The question of fiscal data connects directly to Shoshana Zuboff's analysis in The Age of Surveillance Capitalism. Zuboff shows that value no longer resides solely in the data themselves, but in the capacity to predict and exploit them. A hacked database of tax records is a gold mine for those who know how to cross-reference it with other sources: the predictive algorithms Zara describes in Dileviathan, in the chapter titled The Burning Mirror, transform browsing data, searches, and likes into behavioral predictions. What Zara reveals to Gabriel, insurance companies were buying: algorithms predicted mental health crises, depression, burnout, and adjusted premiums accordingly.

The lesson is direct: tax data are valuable not only for what they contain, but for what they make it possible to predict once cross-referenced. This is why the response to the cyberattack cannot be purely technical. It requires reflection on what data the state should retain, on the mechanisms for sharing it with private actors, and on citizens' capacity to understand what circulates about them without their knowledge.

What This Changes for the Citizen

For the 678,000 people affected, the coming months will bring letters, account monitoring, and uncertainty about how their data will be used. The risk of fraud via fake advisors will increase: the attackers possess precise details with which to personalize their attempts. This is the moment when technical vulnerability becomes social vulnerability.

Beyond the direct victims, what is at stake is trust in the digitization of public services. As the state pushes for the dematerialization of taxes, healthcare, and administrative procedures, every incident feeds a legitimate suspicion. Public cybersecurity requires continuity, not communications management.

The inquiry commission, if it goes forward, will have real work to do: mapping common vulnerabilities, evaluating the effectiveness of the April plan, determining who within the state is genuinely responsible for the security of citizens' data. But the response cannot be limited to additional funding announced after each incident. It requires an acknowledgment that digital sovereignty is not an optional extra — it is the precondition for sovereignty itself.

Key takeaways:

• digital sovereignty is the precondition for sovereignty itself
• tax data are valuable for what they make it possible to predict once cross-referenced
• the response must be structural, not communicational

The question is not whether the state will be attacked again. It is whether, like Gabriel in the novel, it will learn to see the ghost in its own machine before it is too late.

---

Sources

Piratage du fisc : les socialistes demandent une commission d'enquête, Lecornu préside une cellule de crise — Mediapart