Massive taxpayer data leak in France: 678,000 records compromised
The French tax administration (DGFiP) has officially confirmed a critical incident: an attacker gained access to the personal data of 678,000 taxpayers. The leak affected information on income, residential addresses, and property characteristics of citizens.
Attack Details
The attack was carried out between June and July 2026. The hacker used compromised credentials of a tax service employee and an external contractor. Through a VPN connection, they managed to penetrate internal servers and launch an automated data export. The process was only stopped after an emergency access shutdown.
Although the agency blocked suspicious accounts, the initial review did not reveal signs of a leak—this indicates the high complexity and sophistication of the attack. The stolen data includes tax indicators (income, family quotient, withholding rates), as well as cadastral information—addresses and floor areas of real estate properties. It is important to note that taxpayers' personal accounts and their passwords were not compromised.
Data Publication and Reaction
The incident became public on August 12, when a user under the pseudonym ZeroBytes put the database up for sale on a criminal forum for several thousand euros. The specialized resource FrenchBreaches analyzed the posted sample and established that the database contains 392,867 individuals and 285,570 legal entities. Among individuals, 26,805 people declared income exceeding €100,000, 386—more than €1 million, and eight—over €10 million.
The leak also contains identification numbers, dates and places of birth, marital status, contact details, and history of inquiries to the tax service. ZeroBytes claims to possess data on tens of millions of citizens, but this information has not yet been confirmed by official checks.
Cryptocurrency Context and Risks
Of particular concern is the connection of this leak to the rise of "wrench attacks"—violent assaults on cryptocurrency holders. According to Chainalysis, in the first half of 2026, 30 such attacks were recorded in France compared to 19 for all of 2025, with global damages exceeding $30 million.
The combination of income data and physical addresses creates an ideal foundation for preparing such crimes. Although the leak contains no direct indications of cryptocurrency ownership, experts warn of a likely surge in targeted phishing and violent incidents.
DGFiP has already notified CNIL, plans to contact law enforcement agencies, and the Paris prosecutor's office has launched its own investigation. The agency is also working with ANSSI and SHFDS.
My comment: This leak is yet another confirmation that traditional financial institutions remain the weak link in the digital asset ecosystem. Even without direct data on crypto ownership, the combination of income and address information is a ready-made dossier for criminals. Cryptocurrency holders in France and Europe should reconsider their physical security measures, especially if their incomes exceed average levels.