French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks

Summary: An attacker used several dozen stolen DGFIP staff passwords, probably taken by infostealers from unmanaged devices over three months, to extract tax data on a little over 350,000 individuals and a little over 250,000 businesses from the E-Contact tool in June and July. The theft went unnoticed until August 12, when the attacker claimed it on an online forum, seven weeks after the first data was taken; ANSSI attributes it to weak login protection, poorly separated networks and monitoring gaps rather than sophistication.
What's compelling: The DGFIP's SOC reset passwords on June 23 but left the attacker's open ADER session running, and data kept flowing for almost 16 more hours - a reminder that a password reset is not containment. ANSSI's own sensors sit only at the RIE's entry and exit points with no access to application logs, so an attacker using real staff accounts moved 11 GB between June 22 and 25 without triggering an alert.

Read the original at The Hacker News ↗