In France a cyberattack on France’s tax administration exposed sensitive information relating to hundreds of thousands of individuals and businesses. The controversy has become political because critics accuse the state of failing to protect information citizens are legally required to provide. Ministers have apologized and the government is promising stronger cybersecurity measures. The episode raises an unusually clear accountability question: private companies can face enormous penalties for mishandling data, but what happens when the state itself fails? Almost everyone who pays taxes can relate to the issue.