France's tax authority data breach: 678,000 taxpayers affected, crypto community at risk
A large-scale incident in France's financial system: the Directorate General of Public Finance (DGFiP) has confirmed unauthorized access to the data of 678,000 taxpayers. During the attack, the perpetrator gained access to income tax returns, as well as addresses and property characteristics of citizens. This event has direct implications for the security of digital asset holders, given the alarming statistics of physical attacks in France.
Incident Details
The attack on DGFiP's information systems occurred between June and July 2026. The perpetrator used compromised credentials of a tax office employee and an external contractor. After penetrating the internal network via VPN, the hacker launched an automated data extraction process that was only halted after forced access revocation. Notably, the agency's initial review did not reveal signs of a breach, indicating the high sophistication and careful planning of the attack.
The stolen data includes tax information of individuals (income, family quotient, withholding rates), as well as corporate SIREN identifiers. Additionally, the hacker gained access to cadastral records with addresses and floor areas of real estate properties. It is important to note that, according to DGFiP, login credentials for taxpayers' personal accounts were not compromised.
Data Publication and Breach Scale
The incident became public on August 12, when a user under the pseudonym ZeroBytes posted the database on a criminal forum. An analysis of a sample conducted by the resource FrenchBreaches showed that the database contains records on 392,867 individuals and 285,570 legal entities. Among the victims are 26,805 people with income exceeding €100,000, 386 people with income over €1 million, and eight with income exceeding €10 million.
In addition to financial indicators, the leak contains personal data: taxpayer identifiers, dates and places of birth, marital status, contact details, and history of interactions with the tax service. ZeroBytes claims to possess information on tens of millions of citizens, but these statements have not yet been officially confirmed.
Threat to Crypto Investors
This incident raises particular concern in the context of the growing number of "wrench attacks" in France. According to analysts, 30 such attacks on cryptocurrency holders were recorded in the country in the first half of 2026, significantly exceeding last year's figures. The leak combined two critical types of data—income level and physical address—which criminals actively use to prepare such attacks.
Although the stolen data contains no direct information about crypto asset ownership, experts warn of a high likelihood of a surge in targeted phishing. Criminals may use the obtained information to create convincing social engineering schemes aimed at wealthy taxpayers.
My analysis: This incident is not just another leak, but a systemic failure in the protection of critical financial infrastructure. The combination of financial data and physical addresses creates an ideal environment for offline threats, which is especially dangerous for the crypto community. I recommend that digital asset holders in France exercise heightened vigilance and review their personal security measures, considering that attackers may use this information for targeted actions.