France's Tax Authority Just Confirmed a 678,000-Record Breach, and CISA Just Put an AI Framework on a Three-Day Clock

Start with the number that matters most in the DGFiP story, and it isn't 678,000. It's two. France's Directorate General of Public Finances confirmed this week that an attacker extracted tax and cadastral data belonging to 678,000 individuals and businesses — reference taxable income, family quotient, withholding rates, company SIREN numbers, property addresses and sizes — and the entire intrusion ran on exactly two sets of legitimate, impersonated credentials: one belonging to a DGFiP employee, one to an authorized third-party contractor. No exploit chain, no zero-day, no malware payload described in any of the disclosures so far. The intrusions happened across June and July. A threat actor using the handle "ZeroBytes" claimed responsibility and listed a stolen database for sale on the PwnForums hacking forum on August 12, at which point DGFiP's own after-the-fact investigation is what actually established the scope, because the agency's initial access-control review when it cut the accounts off did not detect that data had already been taken. That gap is the real headline: the theft was invisible to the system's own controls until an outside criminal announced it.

There's a second number worth holding onto with appropriate skepticism. ZeroBytes claimed the compromised portal held records on roughly 20 million French citizens and said they'd pulled over 252,000 records covering more than two million people, with scraping the rest estimated to take months. The government's confirmed figure is 678,000. Neither number is independently verifiable from outside the investigation, and the gap between a criminal's marketing claim and an organization's confirmed scope is exactly the kind of thing that needs to stay unresolved in reporting rather than getting rounded to whichever number is more dramatic. What is confirmed: usernames, passwords, and taxpayers' own online account access were not compromised — this was pure credential impersonation at the access-control layer, not a breach of the citizen-facing portal itself. DGFiP has notified CNIL, brought in ANSSI, and begun contacting affected individuals directly. For any organization running on impersonation-vulnerable third-party access — a contractor login, a vendor integration, an outsourced support account — the practical lesson isn't about tax agencies specifically. It's that access-control reviews built to catch unauthorized *logins* aren't the same thing as reviews built to catch unauthorized *data extraction* by someone using a login that looks completely ordinary, and DGFiP's own experience is a clean demonstration of exactly that gap.

Now the one with an actual countdown clock. CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog yesterday — a critical code injection flaw in Ray, the open-source distributed compute engine that underpins a very large share of production machine learning training and inference infrastructure, with more than 43,500 GitHub stars and near 8,000 forks. The mechanism is almost embarrassing in its simplicity: Ray exposes HTTP API endpoints, including /api/jobs and /api/job_agent/jobs/, that exist specifically to accept and execute submitted code — that's the product's entire purpose as a distributed execution engine. Its defense against a malicious website reaching a locally running Ray instance was checking whether the incoming request's User-Agent header started with "Mozilla." Browsers let you set that header to whatever you want. Combine that with DNS rebinding, and a developer running Ray locally who simply visits a malicious website, or loads a malicious ad on an otherwise legitimate page, can have arbitrary code executed on their machine — no phishing link needed, no attachment, just ordinary browsing while a vulnerable service happens to be running in the background. The flaw has already been linked to abuse by the RondoDox botnet and to attacks associated with a campaign researchers are calling ShadowRay 2.0.

The deadline is the part worth sitting with. CISA gave federal civilian agencies until August 20 — three days from the KEV addition — under BOD 26-04, the directive that replaced the old flat fourteen-day remediation clock with a risk-tiered model where vulnerabilities on exposed assets granting full post-exploitation control get compressed to the shortest possible window. That's not a bureaucratic detail; it's a signal about how CISA itself is now triaging urgency, and it applies with equal force outside the federal government. If your organization runs Ray anywhere — developer workstations, CI/CD runners, container images, Kubernetes workloads, cloud data-processing clusters — the fix is version 2.52.0 or later, and the audit needs to go further than the obvious production clusters: check dependency lockfiles, base images, and automated build pipelines for anything that quietly retained a pre-2.52.0 release, because a vulnerable Ray dashboard sitting on a developer's laptop is just as reachable by a malicious ad as one sitting in production.

Earlier this month, Huntress documented an Akira ransomware intrusion worth remembering even though the ransomware itself failed, because the failure illustrates a real defensive gap rather than a real defensive win. An Akira affiliate got in through an exposed SonicWall SSL VPN with no MFA on August 4, moved to the domain controller over RDP within two hours, archived mapped file shares with WinRAR, and exfiltrated the data to an attacker-controlled S3 bucket using the s5cmd tool — all fairly standard tradecraft. Then, to clear the way for encryption, the attacker installed AnyDesk, registered it to survive a reboot into Safe Mode, and rebooted the compromised host into Safe Mode with Networking specifically to disable Huntress's EDR agent and Microsoft Defender's real-time protection — a technique MITRE ATT&CK tracks as T1688 and one that Snatch and AvosLocker have used for years, but new to Akira's observed playbook. For ten minutes, the host had no working EDR and a blinded antivirus. And then the ransomware itself crashed: Safe Mode's stripped-down memory environment left the akira.exe process tree without enough virtual memory to run, throwing out-of-memory and PowerShell errors within seconds of launch. Defender eventually flagged the file on a scheduled scan but couldn't remove it while Safe Mode remained active; only after the attacker rebooted back to normal Windows — restoring real-time protection along with it — did Defender actually quarantine the payload.

Huntress's own read on this is the right one: this was luck, not a defense you can plan around. The attacker still walked away with stolen credentials and files, preserving full leverage for a data-extortion demand even without a single file encrypted, and a host with more physical memory or a larger page file might not have failed the same way. Nothing stops Akira's developers from retooling the encryptor's memory footprint once they notice the pattern. What this incident actually validates is upstream of the ransomware failure entirely: require MFA on every VPN account without exception, and treat unexpected Safe Mode boot events correlated with security services stopping as a high-priority alert in their own right, regardless of what happens after. An EDR agent that goes dark for even ten minutes is the signal — whether the payload behind it works is not something your detection strategy should be counting on.

Three stories, three different failure points — a credential-impersonation gap that outran the agency's own controls, a User-Agent string check standing in for real authentication on infrastructure that runs arbitrary code by design, and a security tool disabled clean while the payload it was supposed to stop happened to choke on something unrelated. None of them needed a sophisticated zero-day to work, and one of them didn't even fully work. That's not a coincidence particular to this week — it's most of what actually happens in the gap between "we have controls" and "our controls caught it."