The topic has been circulating intensely since mid-August 2026, after the public claim of an intrusion by an actor presenting himself under the pseudonym ZeroBytes on a cybercriminal forum on August 12 and 13. This claim forced the Directorate General of Public Finances (DGFiP) and Bercy to break their silence and communicate officially, triggering massive media coverage, public apologies, alerts about scam risks, and debates on the State's cybersecurity. Discussions on X and elsewhere focus on the real scale of the leak, detection delays, privacy risks, and government responses. Verifiable origin of the buzz. On August 12, 2026, ZeroBytes claims to have extracted data via access obtained through credential theft. FrenchBreaches and other specialized observers quickly relay the information, mentioning approximately 678,000 lines. On August 13-14, Bercy confirms the incident. An official press release from the Ministry of the Economy (No. 953, August 14, 2026) details the facts. Director General Amélie Verdier presents the administration's apologies during a press briefing. Victims begin to be notified individually starting August 17 by email or mail. An official FAQ is published. Meanwhile, the Paris prosecutor's office opens an investigation for fraudulent data extraction and criminal association. The CNIL is notified. Established facts and sources. According to the official statement of August 14 and the DGFiP FAQ of August 17, illegitimate access occurred in June and July 2026. They were based on the theft of credentials of a DGFiP agent and an authorized third party. These accesses allowed the consultation and extraction of data concerning a total of 678,000 individuals and professionals. For individuals (a little over 350,000 according to the FAQ), this includes notably the tax identifier, civil status, contact details, family situation, reference tax income, family quotient, withholding tax rate, and lists of messages exchanged via the impots.gouv.fr messaging system (message content for fewer than 250 cases). For professionals (approximately 250,000), company name, SIREN, and addresses. Land registry data (addresses and surface areas of real estate properties) were also consulted; subsequent assessments mention around 430,000 individuals for the cadastral aspect, which is distinct. Users' personal and professional spaces on impots.gouv.fr were not compromised, nor were taxpayers' passwords. The suspicious accesses had been detected and cut off in June then July, but the initial investigations had not identified the exfiltration, deemed sophisticated and carried out by bypassing usual circuits. Awareness of the scale of the theft dates from August 12, following the claim and an alert from ANSSI. ZeroBytes claimed (statements not independently verified) to have already sold data to "two people" for several thousand euros. A third, more limited breach on inheritance data was identified and cut off later. Regarding the second part of the statement: on August 19, 2026, Prime Minister Sébastien Lecornu sent a letter to the Secretary General for Defense and National Security (who oversees ANSSI). He requests the establishment of a "new cyber unit," described as a "contact team" composed of ANSSI agents, tasked with intervening on the front line as soon as there is suspicion of a serious attack on the State's information systems, before, during, and after crises, for a more reactive operational response. A proposal for organization, rules of engagement, resources, and leadership was to be presented by August 21. Lecornu noted that "few ministries are at the required level" in cybersecurity, which he deems "not acceptable." He had already requested an in-depth ANSSI audit of the DGFiP incident. This request comes in the context of several recent cyberattacks targeting the administration (DGFiP, National Education in particular). What is accurate, exaggerated, incomplete, or uncertain. The wording of the statement regarding illegitimate access, the months, consultation/extraction, and the figure of 678,000 is faithful to the official announcements of August 14. The figure groups individuals and professionals for the main tax aspect; the cadastral is presented as parallel or additional depending on the assessments. The hackers have sometimes claimed higher volumes or broader access (up to millions in some unconfirmed statements), but the administration sticks to 678,000 for the core of the incident. Detection of the accesses was rapid, but not that of the exfiltration: the administration acknowledges initial investigations that were "insufficient." No public evidence at this stage establishes the exact identity of the perpetrators, their location, or the concrete exploitation of the data beyond the resale claims. The risks of phishing and targeted scams (fake advisor, etc.) are real and highlighted by the authorities, as tax data is stable and valuable. Attributing the statement to August 14 groups elements from slightly different dates (cyber unit on the 19th). Contradictions and blind spots. The hackers and some media outlets have put forward figures or scopes broader than the official assessment, creating discrepancies. The administration insists on the absence of compromise of user spaces, which limits certain risks (no direct access to accounts), but does not eliminate the danger of identity theft or social fraud. The delay between the events (June-July) and public communication (mid-August) has been criticized, including by unions, even though the DGFiP asserts it only became aware of the theft on August 12. The creation of the cyber unit is a structural response, but its effectiveness, actual staffing, and coordination with existing ANSSI and ministry arrangements remain to be demonstrated; some observers see it as a communications measure in the face of admitted structural weaknesses. The judicial investigation is ongoing; not all victims had been contacted at the time of the initial announcements. No official source has confirmed any breach of payment data or taxpayer passwords. Provisional conclusion. Based on the official statements from the DGFiP and the Ministry of the Economy of August 14, 2026, the FAQ, press conferences, and reports from credible media (Le Monde, Le Figaro, Franceinfo, AFP, etc.), the main part of the statement is accurate: illegitimate access in June-July 2026 did allow consultation and extraction of tax and land registry data affecting approximately 678,000 individuals and professionals. Sébastien Lecornu's request for a new cyber unit at ANSSI aimed at a more reactive response is also confirmed, although formulated on August 19 in a letter. The incident constitutes a major leak of sensitive State data, with a potentially lasting impact on privacy and an increased risk of scams. Technical and judicial investigations and the ANSSI audit are ongoing; the verdict on exact responsibilities, the definitive scale of the extractions, and the effectiveness of corrective measures remains open. Affected individuals are urged to exercise the greatest vigilance regarding unsolicited solicitations and to refer only to official channels (impots.gouv.fr, cybermalveillance.gouv.fr).