August 22, 2026

Newsletter

The European Post

Policy • Diplomacy • Strategic Insight

LATEST
What the EU Taiwan Framework Would Actually Have to DoKorea Signed a Digital Trade Deal That Nobody Has RatifiedCritical Minerals in Mongolia Still Have to Cross Two BordersCan an Indonesia Trade Deal Survive Two Years of RatifyingCross-Border Data Orders Went Live Before the Plumbing DidPlatform Work Rules Take Effect in December and Few Are ReadyCan Europe’s Firefighting Fleet Keep Pace With EU WildfiresThe AI Act Deadline Passed on 2 August and Nothing BitWhy Construction Keeps Shrinking While Confidence ImprovesAccession Talks Stall Again and September 1 Is the TestBrussels Applied a Trade Deal It Cannot Yet RatifyAfrica’s Power Market Now Needs Money More Than BlueprintsLong-Term Budget Talks Enter Autumn Without a Council LineForeign Subsidies Enforcement Now Turns on a Dublin RaidWho Writes Europe’s Telecom Rules Once Copper DisappearsDisability Cards Exist on Paper and Nowhere Else Until 2028Losing Visa-Free Travel Now Takes a Thirty Percent SwingTwenty Flagship Actions Will Test Whether the Culture Compass WorksEurope’s Quality Jobs Act Now Rests on What Unions Do by SeptemberDoes a Three Euro Parcel Duty Change Anything About Cheap ImportsWhat the EU Taiwan Framework Would Actually Have to DoKorea Signed a Digital Trade Deal That Nobody Has RatifiedCritical Minerals in Mongolia Still Have to Cross Two BordersCan an Indonesia Trade Deal Survive Two Years of RatifyingCross-Border Data Orders Went Live Before the Plumbing DidPlatform Work Rules Take Effect in December and Few Are ReadyCan Europe’s Firefighting Fleet Keep Pace With EU WildfiresThe AI Act Deadline Passed on 2 August and Nothing BitWhy Construction Keeps Shrinking While Confidence ImprovesAccession Talks Stall Again and September 1 Is the TestBrussels Applied a Trade Deal It Cannot Yet RatifyAfrica’s Power Market Now Needs Money More Than BlueprintsLong-Term Budget Talks Enter Autumn Without a Council LineForeign Subsidies Enforcement Now Turns on a Dublin RaidWho Writes Europe’s Telecom Rules Once Copper DisappearsDisability Cards Exist on Paper and Nowhere Else Until 2028Losing Visa-Free Travel Now Takes a Thirty Percent SwingTwenty Flagship Actions Will Test Whether the Culture Compass WorksEurope’s Quality Jobs Act Now Rests on What Unions Do by SeptemberDoes a Three Euro Parcel Duty Change Anything About Cheap Imports
August 22, 2026

Newsletter

The European Post

Policy • Diplomacy • Strategic Insight

LATEST
What the EU Taiwan Framework Would Actually Have to DoKorea Signed a Digital Trade Deal That Nobody Has RatifiedCritical Minerals in Mongolia Still Have to Cross Two BordersCan an Indonesia Trade Deal Survive Two Years of RatifyingCross-Border Data Orders Went Live Before the Plumbing DidPlatform Work Rules Take Effect in December and Few Are ReadyCan Europe’s Firefighting Fleet Keep Pace With EU WildfiresThe AI Act Deadline Passed on 2 August and Nothing BitWhy Construction Keeps Shrinking While Confidence ImprovesAccession Talks Stall Again and September 1 Is the TestBrussels Applied a Trade Deal It Cannot Yet RatifyAfrica’s Power Market Now Needs Money More Than BlueprintsLong-Term Budget Talks Enter Autumn Without a Council LineForeign Subsidies Enforcement Now Turns on a Dublin RaidWho Writes Europe’s Telecom Rules Once Copper DisappearsDisability Cards Exist on Paper and Nowhere Else Until 2028Losing Visa-Free Travel Now Takes a Thirty Percent SwingTwenty Flagship Actions Will Test Whether the Culture Compass WorksEurope’s Quality Jobs Act Now Rests on What Unions Do by SeptemberDoes a Three Euro Parcel Duty Change Anything About Cheap ImportsWhat the EU Taiwan Framework Would Actually Have to DoKorea Signed a Digital Trade Deal That Nobody Has RatifiedCritical Minerals in Mongolia Still Have to Cross Two BordersCan an Indonesia Trade Deal Survive Two Years of RatifyingCross-Border Data Orders Went Live Before the Plumbing DidPlatform Work Rules Take Effect in December and Few Are ReadyCan Europe’s Firefighting Fleet Keep Pace With EU WildfiresThe AI Act Deadline Passed on 2 August and Nothing BitWhy Construction Keeps Shrinking While Confidence ImprovesAccession Talks Stall Again and September 1 Is the TestBrussels Applied a Trade Deal It Cannot Yet RatifyAfrica’s Power Market Now Needs Money More Than BlueprintsLong-Term Budget Talks Enter Autumn Without a Council LineForeign Subsidies Enforcement Now Turns on a Dublin RaidWho Writes Europe’s Telecom Rules Once Copper DisappearsDisability Cards Exist on Paper and Nowhere Else Until 2028Losing Visa-Free Travel Now Takes a Thirty Percent SwingTwenty Flagship Actions Will Test Whether the Culture Compass WorksEurope’s Quality Jobs Act Now Rests on What Unions Do by SeptemberDoes a Three Euro Parcel Duty Change Anything About Cheap Imports

A Data Breach France Disclosed Only When Forced

Miralem Pjanić
Breaking News Reporter, Digital and Technology

A data breach at France’s tax administration sat undisclosed for roughly seven weeks, and the gap between discovery and disclosure is the part that should worry policymakers here. The Finance Ministry confirmed late on 14 August that attackers had taken records belonging to close to 700,000 individual and professional taxpayers. Officials only spoke after a criminal forum post advertised the haul.

The Direction generale des Finances publiques detected the intrusion during routine security checks in late June and cut the access off. It said nothing publicly at the time. Reporting by The Record puts the confirmed figure at around 678,000 records, after an actor claimed 600,000 victims. Brussels Signal reported the ministry’s own count closer to 700,000.

The stolen fields matter more than the headline number. For individuals, attackers walked away with full names, family quotient classifications, reference taxable income and withholding tax rates. That combination does not open a bank account on its own. It does something subtler and arguably worse. It tells a fraudster exactly how much a household earns, how many dependants it supports and what the state already knows about it.

Anyone building a convincing phishing message needs precisely that. A caller who can recite your reference taxable income sounds like the tax office. Officials flagged identity theft and solicitation of further personal details as the main risks, and notification letters started going out the following week. The warning arrives after the data has already circulated.

This is where the file becomes a European problem rather than a French one. Tax administrations across the Union exchange data continuously under the directives on administrative cooperation. They will exchange far more once the arrangements around minimum taxation and the VAT reporting overhaul bed in. Every one of those pipes assumes the endpoints hold. A finance ministry is not a peripheral target. It is a concentration of the most sensitive economic information a state holds about its citizens.

The NIS2 directive already classifies public administration entities among those that must manage cyber risk and report significant incidents. Transposition remains uneven, and the Commission has chased several capitals over it. France transposed late. The relevant question is not whether Paris broke a rule. It is whether a seven-week silence between detection and public disclosure is compatible with the spirit of a regime built on fast notification.

The General Data Protection Regulation sets a tighter clock. Controllers must notify the supervisory authority within 72 hours of becoming aware of a personal data breach, and must inform affected individuals without undue delay where the risk to their rights is high. Whether DGFiP told the CNIL in June while telling nobody else is now the sharpest open question. If it did, the failure sits in the decision not to warn taxpayers. If it did not, the failure is larger.

Defenders of the delay will point to the investigation. Announcing a breach while you are still tracing an intruder can help them. That argument carries real weight in the first days. It thins considerably by week five, particularly when the affected people could have been watching their accounts and refusing unexpected calls the whole time.

There is a wider pattern worth naming. European institutions have spent five years writing rules that assume prompt, honest disclosure by the entities they govern, including public ones. Companies face fines when they stay quiet. Ministries mostly face embarrassment. Until that asymmetry closes, the incentive to manage a data breach as a communications problem rather than a citizen protection problem will keep winning.

The practical follow-on is unglamorous. Expect questions in the European Parliament about whether public-sector entities are meeting NIS2 incident reporting duties in practice, not just on paper. Expect the CNIL to say something. And expect the 678,000 people receiving letters this month to draw their own conclusion about how quickly the state tells them when it loses their file.

Comments