Massive data leak from the French tax authority: a threat to cryptocurrency holders
The French tax administration (DGFiP) has officially confirmed a major data breach affecting 678,000 taxpayers. As a result of unauthorized access, the attacker obtained confidential information about citizens' incomes, as well as addresses and technical characteristics of their real estate.
Incident Details
The attack on DGFiP's information systems was carried out between June and July 2026. The attacker used the credentials of a tax service employee and an external contractor. According to the hacker, he managed to penetrate internal servers via VPN, gain access to search tools, and launch an automated data export. The process was only stopped after forced access termination.
The agency blocked the compromised accounts after detecting suspicious activity, but the leak was not identified during the initial review. DGFiP attributes this to the high complexity and sophistication of the attack.
The hacker obtained individual tax returns, including reference income, family quotient, and withholding tax rates. Additionally, company names and SIREN registration numbers were stolen, along with cadastral information — addresses and floor areas of real estate properties. It is important to note that taxpayers' personal accounts, their logins, and passwords remained untouched.
Data Publication and Its Scale
The incident became public knowledge on August 12, when a user under the pseudonym ZeroBytes put the database up for sale on a shadow forum for several thousand euros. The hacker claimed to have posted 678,438 rows, emphasizing that this was only part of the obtained data array.
Independent resource FrenchBreaches analyzed the published sample and determined that the database contains data on 392,867 individuals and 285,570 legal entities. Among individuals, 26,805 people declared income exceeding €100,000, 386 — more than €1 million, and eight — over €10 million. In addition to financial indicators, the database contains taxpayer identifiers, dates and places of birth, postal addresses, marital status, number of dependents, contact phone numbers, email addresses, and history of inquiries to fiscal authorities.
ZeroBytes claims to possess data on tens of millions of French citizens, but neither DGFiP nor independent experts have yet been able to confirm these statements. The agency has already notified CNIL, plans to contact law enforcement, and will inform victims. The investigation is being conducted jointly with SHFDS and ANSSI, and on August 15, the Paris prosecutor's office also brought OFAC into the investigation.
Direct Threat to the Crypto Community
This incident poses a particular danger to digital asset holders. France has long been the epicenter of so-called wrench attacks — violent assaults on crypto investors aimed at forcing the transfer of funds. According to Chainalysis, 30 such attacks were recorded in the country in the first half of 2026 alone, compared to 19 for the entire year of 2025. Global damage from such crimes since the beginning of the year has exceeded $30 million.
The combination of income data and physical addresses is exactly the set of information criminals use to prepare and carry out wrench attacks. Analysts have repeatedly pointed to leaks of this kind as a key factor in the surge of attacks in France. In 2024, a tax service employee in the Paris region was already caught selling files on wealthy crypto asset owners to criminal intermediaries. After this case was made public in January 2026, the frequency of attacks rose from 1.9 to 4.6 cases per month.
The current leak contains no direct indications of cryptocurrency ownership, and FrenchBreaches experts found no signs allowing digital asset holders to be identified. Nevertheless, specialists warn of a likely surge in targeted phishing aimed at victims from this database.
My analysis: This incident is not just another leak, but a systemic failure in the protection of critical financial infrastructure. For crypto investors, this is an alarming signal: the combination of financial data with residential addresses creates ideal conditions for offline threats. I recommend that holders of large sums in digital assets review their personal security measures, especially given that French tax authorities have already been compromised before. The question is not whether this data will be used, but how quickly and aggressively it will happen.