France's largest tax data leak: 678,000 citizens at risk of physical attacks
The French tax authority (DGFiP) has officially confirmed a large-scale data breach. Information about the income, addresses, and property characteristics of 678,000 taxpayers fell into the hands of an attacker. In my view, this event is not just a routine information security incident, but a warning signal for the entire crypto community.
Timeline and Scale of the Attack
The intrusion into DGFiP's information systems occurred between June and July 2026. The attacker used compromised credentials belonging to a tax office employee and an external contractor. After gaining access to internal search tools via VPN, the hacker launched an automated data extraction. The process was only halted by an emergency access shutdown after anomalous activity was detected.
Notably, an initial review found no traces of the leak, indicating a highly sophisticated and well-planned attack. The stolen data includes individual tax returns, company identification numbers (SIREN), and a vast array of cadastral information. However, as the agency emphasizes, access to taxpayers' personal accounts, their logins, and passwords was not obtained.
Data Publication and Market Reaction
The situation became public on August 12, when a user under the pseudonym ZeroBytes put the database up for sale on a criminal forum. According to the attacker, the initially stated volume of 678,438 rows is only a small part of the stolen dataset. An analysis conducted by the specialized resource FrenchBreaches showed that the database contains records on 392,867 individuals and 285,570 legal entities. Within the sample, data was found on 26,805 people with income from €100,000, 386 with income over €1 million, and eight with income exceeding €10 million.
Direct Threat to Cryptocurrency Holders
The combination of two types of data—income level and physical address—is of greatest concern. This very combination is a key factor in organizing so-called wrench attacks—violent assaults aimed at forcing the transfer of crypto assets.
France has already become an epicenter of such crimes: according to analysts, 30 such incidents were recorded in the country in the first half of 2026, compared to 19 for the entire previous year. Global losses from this type of crime have exceeded $30 million. Notably, a previous similar case—a data leak from the Paris regional tax office in 2024—led to an increase in attack frequency from 1.9 to 4.6 cases per month.
Although the current leak contains no direct indications of cryptocurrency ownership, the risk of targeted phishing and physical attacks remains extremely high. Digital asset holders in France should be especially vigilant and reconsider their personal security protocols.
My analysis: this leak is not just a data breach, but a ready-made dossier for organized criminal groups. The coincidence of financial information with precise residential addresses creates ideal conditions for targeted attacks. I recommend that all wealthy cryptocurrency holders in France immediately strengthen their physical security and consider changing addresses linked to tax declarations.