Two months passed before France told its taxpayers that someone had been inside the state’s tax systems. The Ministry of Finance said its investigators had confirmed a “malicious actor’s” claim of a break-in at the General Directorate of Public Finances (DGFP) in late June. The disclosure came on August 14.
How many people are affected, and what was taken, is still unknown. The ministry said further investigations are underway and that anyone hit will get a personalized notice explaining which data may have been viewed or extracted and, where needed, what precautions to take.
The hackers have put a number on it. FrenchBreaches, a platform that tracks cyberattacks in France, said the attackers told it the breach covers data on nearly 700,000 taxpayers. According to Reuters, the ministry did not answer FrenchBreaches’ request for comment.
A second wave, aimed at corporations
Separately, the ransomware group Cl0p posted on its website that it had stolen large volumes of data from nearly 50 companies worldwide. Philips, Shell, Fiserv and GE were among the names listed. Cl0p is reported to have earned $500 million from ransomware. Reuters could not verify the group’s claims, and Cl0p did not reply to its request for comment.
The companies answered in very different tones. Philips confirmed it had been targeted, saying it spotted and contained an attempted breach of one company server tied to internal data. Customer environments were not touched, it said. Shell acknowledged a “possible incident”, after Dutch outlet BNR reported on it, and a spokesperson said: “We are working with security teams and relevant experts to investigate the situation.”
Fiserv was firmer. It knows of the claims, a spokesperson said, but so far has found no sign that customer, banking, transaction or personal data was breached, or that its operating environment was affected. GE said it has switched on its cyber incident response protocols while it assesses the claim.
How the hackers may have got in
Nobody has said how the attackers broke in. One lead comes from Ransom-ISAC, an industry information-sharing group, which warned on July 22 that Cl0p was exploiting flaws in PTC Windchill and FlexPLM, software that supports engineering and manufacturing.
Brandon Parsons, director of threat intelligence at Ascent Solutions and the author of that warning, said some companies started receiving notices from Cl0p on July 19 or 20. He called the group “professional data extortionists” that go after widely used software rather than particular firms. “They’re not really targeting a specific company, they’re targeting a specific zero-day vulnerability and exploiting it,” Parsons said. A zero-day is a security gap with no fix yet available.
France has been hit before this year. In February, medical data belonging to 15 million French citizens was stolen. That same month the finance ministry reported that a hacker, using a stolen official’s credentials, had searched a bank database covering 1.2 million accounts and reached details such as account numbers, holder names and addresses.
