Last June and July, attackers accessed France's tax administration systems using stolen staff credentials and extracted data on hundreds of thousands of taxpayers and businesses. The breach went undetected for seven weeks—not because the attack was technically sophisticated, but because the infrastructure lacked adequate visibility into what authenticated users were doing once inside the network.

The Credential Problem Runs Deeper Than Password Hygiene

Credential theft is asymmetric: an attacker with valid login details looks, to most monitoring systems, like an authorised user. This is the central difficulty. A person logging in with a stolen password from an unexpected geographic location, at an unusual time, downloading gigabytes of tax records—should each of these trigger an alert. Often, none do.

The French authorities found no sign of the exfiltration in real time. This points to either absent or poorly tuned detection rules. Organisations commonly log authentication events but skip the harder work: correlating user behaviour against a baseline, tracking lateral movement patterns, monitoring for unusual data access volumes, or watching outbound traffic for signs of exfiltration. When a system sees only login, logout, and file permissions—without also seeing what's being transferred and where—gaps of weeks become plausible.

Attackers understand this. A credential bought or stolen from a forum costs less than developing a zero-day exploit. Once inside, they move slowly, accessing files in ways that mimic normal work patterns. No buffer overflow, no kernel vulnerability, no sophisticated payload delivery. Just patience and access.

Detection Requires Visibility at Multiple Layers

Preventing credential theft entirely is difficult—phishing, password reuse, and social engineering remain effective. But detecting its misuse is a solved problem, if implemented. The gap here wasn't technological; it was architectural.

A mature detection strategy treats authenticated access as the starting point, not the endpoint. This means:

The French case suggests at least one of these was absent or ineffective. According to reports on the breach, the attack was described as unsophisticated—which is another way of saying it shouldn't have succeeded. Basic monitoring would have stopped it in hours, not weeks.

Why This Matters for Hosted Infrastructure Operators

Organisations running offshore hosting, VPS, or dedicated servers often inherit this same blind spot. A customer's weak password, phished from an employee, gives an attacker console access to a virtual machine or account panel. Without egress monitoring and baseline alerting, they may extract backups, databases, or customer records before anyone notices.

For operators managing multi-tenant environments or handling sensitive workloads, the lessons are clear. Assume credential compromise will happen. Build detection around it. Monitor what authenticated sessions do, not just whether they authenticate. Track data flows. Alert on anomalies. The seven-week detection lag in France happened because someone, somewhere, decided that logging login events was sufficient. It never is.

The Cost of Assumptions

A common refrain in security is that prevention is preferable to detection. That's true in the abstract. In practice, prevention fails regularly. People reuse passwords, fall for phishing, leave credentials in files. The difference between a contained incident and a catastrophic breach often depends not on whether credentials were stolen, but on whether the organisation had the visibility to spot their abuse quickly.

The French tax authority's seven-week gap wasn't a failure of password policy or vulnerability patching. It was a failure of observability—the absence of systems designed to see what was actually happening inside the network in real time. For any organisation holding sensitive data, that's the more dangerous oversight.