As France prepares for the mandatory rollout of business-to-business electronic invoicing on September 1, 2026, a recent major data breach at the public finances administration has triggered political demands to suspend the reform over cybersecurity fears.
The Fiscal Administration Data Breach and Cybersecurity Concerns
The timing of a cyber incident at the Directorate General of Public Finances (DGFiP) has intensified anxieties among business owners across the country. The DGFiP confirmed at least three malicious intrusions on its servers since June 2026, leading to a notified data violation on August 14, 2026. The incident exposed detailed fiscal information belonging to 678,000 individuals and businesses, including 250,000 corporate entities, though the National Commission on Informatics and Liberty (CNIL) verified that the exposed records did not include passwords or login identifiers.
DGFiP Director General Amélie Verdier downplayed the severity of the exposed professional data, stating that the accessed files largely consisted of public or quasi-public information. Nevertheless, the breach has shaken confidence within the business community. Jean-Marc Barki, CEO of industrial SME Stikoïa and LR municipal councillor for the 15th arrondissement of Paris, called the situation a scandal
and voiced a lack of trust in state-operated digital structures, according to reporting from Challenges. Similarly, Cédric Dumas, head of a three-person industrial equipment firm, questioned the administration’s defensive readiness, noting that he possesses greater confidence in his own firm’s cybersecurity solutions than in those maintained by the state.
Political Backlash and Calls for Suspension
The security lapse at Bercy prompted prominent political figures to demand an immediate halt to the upcoming electronic invoicing mandate. David Lisnard, the mayor of Cannes and a candidate for the 2027 presidential election, posted a statement on X declaring that the state is clearly unreliable and cannot guarantee the security duties it imposes on companies.
European Parliament member Sarah Knafo also issued a direct appeal on X to public officials, demanding the immediate suspension of the electronic invoicing obligation. Knafo argued that an administration incapable of protecting citizen data lacks the legitimacy to centralize further financial information. Independentist senator Vincent Louault echoed these criticisms, questioning whether the state possesses the capability to safeguard sensitive records.
Despite these high-profile protests, legal analysts and economic publications emphasize that the political appeals carry no immediate legal effect. The foundational framework established by Decree No. 2024-266, published on March 25, 2024, remains fully in force on Légifrance without any modifying texts.
Implementation Roadmap and Technical Architecture
As the September 1, 2026 deadline arrives, the rollout rules depend heavily on corporate scale. Every enterprise subject to Value Added Tax (VAT) must be capable of receiving electronic invoices, utilizing either the Public Billing Portal (PPF) or one of approximately 137 to 150 approved private partner platforms. Meanwhile, large enterprises and intermediate-sized companies (ETIs) face an immediate mandate to emit electronic invoices and transmit transaction data, whereas micro-enterprises and small-to-medium businesses (SMEs) have an additional year until September 1, 2027, to comply with emission requirements.
To address security concerns, tax authorities maintain that the digital invoicing framework relies on a fundamentally decentralized architecture. According to analyses from specialized monitoring outlets, electronic invoices circulate directly between certified platforms, while a central directory functions strictly as a routing mechanism. Officials emphasize that the recent server intrusions have no operational link to the electronic invoicing reform network. Furthermore, Amélie Verdier noted that all approved platforms underwent mandatory security audits designed for regular renewal.
Yet internal skepticism persists within public service unions. Beyond cybersecurity, smaller independent traders and agricultural operations remain anxious about administrative penalties, noting that errors or forgotten transmissions could trigger fines of 50 euros per infraction.
