DGFiP: why changing a password may not be enough to stop an attack

On 29 September 2026, ANSSI published its incident report on the cyberattacks that affected France’s public-finance administration during the summer.1

The most useful lesson is not an exotic exploit. ANSSI groups the weaknesses it observed around three domains: identity, architecture and detection.

That combination matters far beyond DGFiP. When an attacker uses valid credentials and reachable services, each component can treat an action as locally legitimate while the complete sequence is abnormal.

A valid credential does not prove a legitimate user

The ministry’s initial statement said the illegal access relied on impersonated credentials belonging to a DGFiP agent and an authorised third party.3

This changes the operational question from “is this account allowed?” to “is this use of the account consistent with its expected context?”

Location, device, time, source address, connection frequency and data volumes become part of the security picture.

Account, password and session are different objects

Resetting a password or disabling an account is essential after compromise, but modern architectures also contain active sessions, cookies, access tokens, federated identities and temporary roles.

A useful model separates:

identity → authentication → session → portal → application → data

Cutting one element does not automatically prove that every downstream trust object has been invalidated.

Incident-response teams should therefore know who issues each session or token, how long it remains valid, how it can be revoked and which applications trust it.

Architecture turns compromised identity into an attack path

A stolen credential matters because it can reach something.

Architecture therefore adds a second question: what could this identity reach after connecting?

The useful representation becomes:

account → portal → network → application → dataset

with controls layered onto the path:

MFA → filtering → segmentation → authorisation → logging

Impact is determined by the complete chain, not by the account alone.

Logs are not the same as an end-to-end story

Detection is the third domain highlighted by ANSSI.1

A portal can record a login. An application can record queries. A network sensor can observe traffic. A SIEM may receive some of these events.

Separately, each event can look acceptable. Correlated, they can tell a very different story.

The practical SOC question is therefore: can we follow one identity from entry point to the data it accessed?

What an incident-ready map should connect

At minimum, organisations should be able to connect five families of objects:

Identities: accounts, groups, roles and authorised third parties.

Entry points: VPNs, portals, bastions and federation services.

Components: applications, servers, APIs and networks.

Data: datasets and business functions that can be reached.

Telemetry: logs, sensors, SIEM coverage and owners of those traces.

A server-only map is insufficient. An identity-only view is insufficient too.

The useful model connects who can enter, where, what they can reach, under which authorisation, and where that activity can be observed.

A simple exercise

Choose one account with sensitive access and simulate its compromise.

Identity: can you disable it and invalidate its active sessions and derived permissions quickly?

Architecture: can you list every application and dataset reachable from its entry point within minutes?

Detection: can you reconstruct its activity across several systems without manually collecting logs from multiple teams?

Responsibility: do you know who must act on each component in the path?

If those answers require hours of investigation, the organisation may possess the information without having operational visibility.

The lesson is broader than DGFiP

In September, ANSSI reinforced its REACTIV capability in response to data breaches affecting government services, with a focus including account compromise and data exfiltration.4

The DGFiP case should not be copied mechanically onto other architectures. Its useful lesson is methodological.

An identity compromise becomes more dangerous when architecture provides a path and monitoring cannot correlate the complete sequence.

Compromised identity + reachable path + incomplete visibility = an exfiltration risk that is harder to detect.

Defence therefore needs the same continuity as the attack.

The account is only the beginning of the path.