French tax authority breach went undetected for seven weeks using stolen staff passwords

France's national cybersecurity agency, ANSSI, has published a detailed report revealing that an attacker used stolen staff passwords to access and exfiltrate tax data on hundreds of thousands of taxpayers and businesses over a seven-week period in June and July 2026. The Hacker News reports that the attack was not technically sophisticated but succeeded because of weak credential controls and insufficient monitoring. Neither the tax administration nor ANSSI detected the data leaving the network during the breach window. The attacker used legitimate credentials belonging to staff members, allowing them to access internal systems without triggering alerts. The breach was only discovered after external indicators pointed to the compromise.

Why this matters for UK organisations

This incident illustrates how credential theft remains one of the most effective and difficult-to-detect attack methods. The attacker did not need to exploit a vulnerability or deploy malware; they simply used valid credentials to access systems as though they were authorised users. This highlights the operational challenge of distinguishing between legitimate and malicious activity when attackers are using real accounts. It also underscores the importance of monitoring for unusual access patterns, implementing multi-factor authentication on privileged accounts, and ensuring that logging and alerting are configured to detect anomalous behaviour even when credentials are valid. The seven-week detection gap is a stark reminder that visibility into how systems are being used is just as important as preventing unauthorised access in the first place. For organisations holding sensitive data, the operational lesson is that credential-based attacks can persist for extended periods if monitoring and alerting are not tuned to detect unusual data access, export or transfer patterns.

What to review

UK organisations should review whether credential-based access to sensitive systems is adequately monitored and whether multi-factor authentication is enforced across privileged accounts. It is also worth considering whether current logging and alerting would detect prolonged unauthorised access using valid credentials, particularly where large volumes of data are being accessed or exported over time. Organisations should confirm that data loss prevention mechanisms are in place and that alerting is configured to flag unusual patterns such as bulk data downloads, access outside normal working hours or access from unexpected locations. This incident is a prompt to review whether credential hygiene, monitoring and alerting are treated as core operational controls rather than optional enhancements, and whether responsibility for detecting and responding to credential-based attacks is clearly assigned.

Source: The Hacker News