PARIS, Sept. 9 — France’s finance ministry has confirmed that a malicious actor breached the systems of the General Directorate of Public Finances (DGFP) in late June, disclosing the incident on August 14 after investigations verified unauthorized access. The ministry is still determining how many taxpayers are affected and exactly which data was compromised, though it has pledged personalized notices to impacted users detailing what may have been viewed or extracted. The tracking platform FrenchBreaches reported that hackers claim the breach involves data on nearly 700,000 taxpayers.
The ministry did not respond to FrenchBreaches’ request for comment, according to Reuters, which could not independently verify the claims. In a separate but parallel wave, the hacker group Cl0p — known for ransomware attacks reportedly generating $500 million in revenue — claimed on its website to have stolen large volumes of data from nearly 50 companies worldwide.
The named targets include Philips, Shell, Fiserv, and GE. Philips admitted it had been targeted by Cl0p, saying it identified and contained an attempted breach on a specific company server linked to internal data. The company stressed the incident does not affect customer environments.
Shell said it was aware of a possible incident, confirming a report from Dutch news outlet BNR. A spokesperson said, “We are working with security teams and relevant experts to investigate the situation.” Fiserv pushed back harder.
A spokesperson said the company found no evidence of customer, banking, transaction, or personal data breach. GE said it activated its cyber incident response protocols. Reuters could not independently verify any of the group’s claims.
Ransom-ISAC issued a warning on July 22 that Cl0p was exploiting vulnerabilities in PTC Windchill and FlexPLM, software used in engineering and manufacturing. Brandon Parsons, director of threat intelligence at Ascent Solutions and author of the warning, said companies began receiving notices from Cl0p on July 19 or 20. He described the group as “professional data extortionists” who target zero-day vulnerabilities in widely used software — not specific companies.
The incidents occur amid growing concern about artificial intelligence’s role in cyberattacks. The DGFP has yet to publish its final tally of affected taxpayers, and Cl0p’s full list of victims is still unconfirmed.
