Detection Engineer: 2026-09-30

1. French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks

   The Hacker News, 2026-09-29. Read, 7 min.

   ANSSI's incident report on France's tax administration, the DGFIP, found that an attacker logged in to portals that asked only for a password, using staff passwords probably taken by infostealers from computers the DGFIP did not manage. Neither the DGFIP's SOC nor ANSSI's monitoring saw the data leave, and the theft became known only when the attacker claimed it on August 12.

   Why it matters for this role: Correlate night logins, VPN or known-bad source addresses, and per-user request counts on business applications, because ANSSI says those signals together could have raised an alert that none raised alone.

Detection Engineer