Massive data leak in France: 678,000 taxpayers at risk of physical attacks
The French tax administration (DGFiP) has officially confirmed an unprecedented personal data breach affecting nearly 680,000 taxpayers. The attacker gained access not only to citizens' income information but also to their physical addresses and property data.
Incident Details
The attack on the agency's information systems occurred between June and July 2026. The attacker used compromised credentials belonging to a tax service employee and an external contractor. Through a VPN connection, the hacker gained access to internal search systems and launched an automated data export, which was only stopped by completely disabling access.
Notably, the initial check after detecting suspicious activity did not reveal the breach—the sophistication of the attack allowed the attacker to remain undetected for an extended period.
What Was Stolen
The hacker obtained individual tax returns, including reference income, family quotient, and withholding rates. Data on companies was also compromised, including SIREN identification numbers. Of particular concern is access to cadastral information—addresses and floor areas of real estate properties.
According to the independent resource FrenchBreaches, the leaked database contains 392,867 records on individuals and 285,570 on legal entities. Among the victims are 26,805 people with income exceeding €100,000, 386 taxpayers with income over €1 million, and eight individuals whose income exceeds €10 million.
Cryptocurrency Context and Physical Security Threat
This incident poses a particular danger to cryptocurrency holders in France. The country has already become the global epicenter of so-called wrench attacks—violent assaults aimed at forcing the transfer of digital assets. According to Chainalysis, 30 such attacks were recorded in France in the first half of 2026, compared to 19 for all of 2025.
The combination of income data and physical addresses creates an ideal foundation for preparing such crimes. Analysts have previously warned that it is precisely leaks of this kind of information that trigger a surge in attacks.
The 2024 case is telling, when a tax service employee in the Paris region sold dossiers on wealthy digital asset owners to criminal intermediaries. After this case was made public in January 2026, the frequency of wrench attacks increased from 1.9 to 4.6 cases per month.
My comment: Although the stolen data contains no direct indications of cryptocurrency ownership, criminals can combine this information with other leaks to identify potential victims. I recommend that digital asset holders in France strengthen physical security measures and remain especially vigilant against targeted phishing attacks in the coming months.