France's tax data leak: 678,000 taxpayers affected, crypto community at risk
The French tax authority (DGFiP) has officially confirmed a massive compromise of citizens' personal data. As a result of a targeted attack, the attacker gained access to information about the income, addresses, and real estate of 678,000 taxpayers. This event, which occurred between June and July 2026, has already been called one of the most serious leaks in the history of the French state financial system.
Technical details of the incident
The attack was carried out using compromised credentials of a DGFiP employee and an external contractor. The attacker, operating through a VPN, gained access to internal search systems and launched an automated data export. Notably, the agency's initial check did not reveal traces of the intrusion, indicating the high complexity and sophistication of the attack. Only a subsequent access shutdown managed to stop further theft.
The stolen data set includes not only tax returns (income, family quotient, withholding rates) but also cadastral information: exact addresses and floor areas of real estate properties. In the sample published on the specialized resource FrenchBreaches, data on 392,867 individuals and 285,570 legal entities was found. Among the victims are 26,805 people with income from €100,000, 386 people with income over €1 million, and 8 people whose income exceeds €10 million.
Analysis of the leaked data revealed a full range of sensitive information: taxpayer identification numbers, dates and places of birth, marital status, number of dependents, contact details, and even the history of appeals to tax authorities. The attacker, operating under the pseudonym ZeroBytes, claims that this is only a small part of what was stolen and that he has data on tens of millions of citizens at his disposal. However, official checks have not yet confirmed these statements.
Direct threat to cryptocurrency holders
Of particular concern is the fact that this leak combined two key elements used by criminals when preparing so-called "wrench attacks" (violent assaults aimed at forcing the transfer of crypto assets): the victim's income level and their physical address. France is already the world's epicenter of such crimes — 30 such attacks were recorded in the first half of 2026, compared to 19 for the entire year of 2025.
In 2024, an employee of the tax service in the Paris region was caught selling files on wealthy digital asset owners. After this case was made public in January 2026, the frequency of attacks rose from 1.9 to 4.6 cases per month. Although the current leak contains no direct indications of cryptocurrency ownership, experts warn of an inevitable surge in targeted phishing and possible escalation of offline threats.
My analysis: This incident is not just a data leak, but a systemic failure in the protection of state institutions. The combination of financial and geolocation information creates an ideal "target map" for organized criminal groups. Cryptocurrency holders in France and Europe should immediately reconsider their physical security measures and be prepared for a wave of fraudulent schemes using the stolen data. The question is not whether an attack will occur, but when exactly.