On 29 September 2026, France's national cybersecurity agency (ANSSI) made public its report on the cyberattack that targeted the Direction générale des finances publiques (DGFiP), the French public finance directorate. As a result, the personal data of 350,000 taxpayers (cadastral, inheritance and tax data) was exfiltrated (source: ANSSI, incident report, 29 September 2026). What stands out is not the figure but the analysis: the agency identifies three areas of operational weakness, and none of them is specific to public administration.
What the report describes
The ANSSI does not characterise the attack as sophisticated. It describes it as the exploitation of weaknesses in three areas: identification, detection and IT architecture. This distinction matters. Sophisticated attacks are rare and hard to prevent. Weaknesses in identification, detection and architecture are common, well documented and fixable.
The report points in particular to the number of accounts for which the attacker held valid username and password pairs. The agency notes that this volume indicates prolonged exposure to phishing campaigns or to databases of compromised credentials. This was not a sophisticated initial access. It was the reuse of passwords recovered elsewhere, with no additional authentication barrier.
A second finding, stated directly by the ANSSI: "The cumulative volume of requests the attacker had to generate should have triggered alerts." This is not a theoretical assumption. It is a finding of absence: the requests took place, the volumes were abnormal, and no alerts were generated.
The three blind spots in detail
The first blind spot concerns identification. The attacker used valid credentials. Post-authentication behavioural detection, which monitors what an account does once logged in rather than whether it is allowed to log in, was either not in place or not calibrated. The absence of systematic multi-factor authentication across all applications lowered the entry barrier.
The second blind spot concerns detection. The ANSSI points to insufficient monitoring and excessive access to business resources. The two are linked: when access rights are broad, background noise is high, and malicious activity drowns in legitimate activity. Setting relevant alert thresholds first requires reducing the access surface down to the principle of least privilege.
The third blind spot concerns architecture. The report mentions insufficient mapping of network flows. A network that is not sufficiently segmented does not contain the lateral movement of an attacker who has gained a first foothold. Exfiltration can cross several systems without the flows being recognised as abnormal, precisely because no baseline of normal flow has been established.
Why your NIS2 entities probably share these blind spots
Since 1 August 2026, 99 data breaches have been reported to the ANSSI, of which 67 are confirmed and 32 are being processed (source: ANSSI, situation update of 30 September 2026). This volume over two months indicates that the DGFiP problem is not isolated.
The same weaknesses recur in incidents investigated by the ANSSI and by European supervisory authorities: compromised credentials used without an alert, reactive rather than behavioural detection, access rights not reviewed for months. These are technical and organisational debts that accumulate, not zero-day vulnerabilities.
For your NIS2 teams, the question is not "are we more secure than the DGFiP?". It is: do our detection controls cover the same blind spots as those identified in this report? If your SIEM has no correlation rule for abnormal volumes of requests, if your MFA is not deployed across all business applications, or if your flow mapping has not been updated since the last significant architecture change, the answer is probably no.
Three concrete checks to run now
The first check concerns your MFA coverage. List all applications that access sensitive data or administrative functions. For each, verify whether multi-factor authentication is active for all accounts, including service accounts and contractor accounts. Exceptions are the first to be exploited.
The second check concerns your detection rules. Ask your SOC team or your monitoring provider whether correlation rules exist for the following scenarios: abnormal volume of authenticated requests from a single account over a short period, access at unusual times or from unusual locations, massive file downloads through remote access. If these rules do not exist, this is precisely what the ANSSI report identifies as having been missing at the DGFiP.
The third check concerns your access rights. How many accounts have access to sensitive business data without that access being strictly necessary for their role? A documented and traceable six-monthly review of access rights is an explicit requirement of the ANSSI's ReCyF v2.5, reinforced in the September 2026 update. This review must cover both active user accounts and service accounts, which are frequently overlooked by least-privilege programmes.
What the CNIL is announcing in parallel
The CNIL has announced that an inspection of the DGFiP will follow the data theft. For entities subject to both NIS2 and GDPR, this scenario, a cybersecurity incident triggering a NIS2 inspection and a GDPR investigation at the same time, is the one your procedures must anticipate. Coordination between the two regimes is not automatic: deadlines differ, recipients differ, and the information to be produced only partly overlaps.
The practical modalities of this dual procedure are detailed in the analysis GDPR and NIS2: one incident, two notifications. The DGFiP is not a NIS2 entity, but the scenario it illustrates is exactly the one your teams risk facing.
What this report requires of your programme
A publicly available post-incident report from the ANSSI becomes a reference for your inspectors. If your NIS2 programme does not integrate the lessons from major incidents investigated by the agency, you will struggle to justify that your measures are appropriate to the actual threat landscape, within the meaning of Article 21 of the directive.
This is not a formal obligation to follow every ANSSI report recommendation point by point. It is a practical constraint: when a report identifies systemic weaknesses across the French ecosystem, inspectors naturally check whether the same weaknesses exist at the entities they inspect.
The three blind spots identified here, insufficient MFA on identification, absent behavioural detection, and uncontrolled access rights, are precisely the elements your NIS2 inspector will check first. Your next actions do not need to be numerous. They need to be targeted at these three areas, documented, and dated.