Last week, ANSSI, France’s national cybersecurity agency, published its report on the cyberattacks that targeted the DGFiP, the French tax authority, this summer. And there is cause for alarm, because neither of the two waves of exfiltration was detected.
Not by the DGFiP, nor by the agency’s monitoring systems.
Around 350,000 individuals and 250,000 business accounts are affected, with sensitive data: tax number, address, family situation, number of tax shares, withholding tax rate. Yet the method is simple, starting from legitimate credentials that were stolen and then reused.
Meanwhile, since 1 September, more than seven million VAT-registered companies must be able to receive their invoices through an approved platform.
Quentin Adam, CEO of Clever Cloud, highlights an important point in this government initiative: going paperless is a good move, but beware of centralising.
Because when all the data is centralised around a few players, the country’s entire economic map becomes visible: who invoices what, to whom, at what price, with what payment terms… This can create a real stake around a potential “information war”.
That is exactly what a text usually presented as an administrative constraint says: GDPR, Article 5, data must be “adequate, relevant and limited to what is necessary”.
So, with a view to sharing only what is strictly necessary. More than a compliance chore, it is above all a safeguard, so that data we never collected cannot leak, cannot be resold, cannot fund a ransom.
At France-IX, all employees (not only the technical or legal teams) will be trained in GDPR in the coming weeks. It is a hygiene worth adopting to learn how to protect our companies.
This news was first published on LinkedIn. To comment or share it, head to the original post. → See the post