Data leak of 678,000 French taxpayers: a threat to cryptocurrency holders
The French tax authority (DGFiP) has officially confirmed a massive compromise of personal data belonging to 678,000 taxpayers. During the attack, the perpetrator gained access to information about income, addresses, and property characteristics of citizens. This is not just another incident—it is a serious signal for the entire crypto community.
Incident Details
The attack on DGFiP's information systems occurred between June and July 2026. The perpetrator used compromised credentials of a tax service employee and an external contractor. After penetrating internal servers via VPN, the hacker launched an automated data export, which was only stopped by an emergency access shutdown.
Despite blocking suspicious accounts, the initial investigation did not reveal traces of the leak—the agency attributes this to the high complexity of the attack. As a result, the perpetrator gained access to individual tax returns, including reference income, family quotient, and withholding rates, as well as corporate SIREN identifiers and cadastral information.
It is important to note: taxpayer personal accounts and their passwords were not compromised. However, on August 12, a user under the pseudonym ZeroBytes listed the database for sale on a criminal forum for several thousand euros, claiming it was only part of the obtained data. The specialized resource FrenchBreaches, after examining a sample, counted 392,867 individuals and 285,570 legal entities, including 26,805 people with income exceeding €100,000 and 386 with income over €1 million.
Cryptocurrency Threat and Physical Attacks
This incident directly intersects with the growing problem of so-called wrench attacks—violent assaults on cryptocurrency holders. France has already become an epicenter of such crimes: according to Chainalysis, 30 attacks were recorded in the first half of 2026, compared to 19 for all of 2025, with global damages exceeding $30 million.
The leak combined two critical types of data—victims' income levels and physical addresses, which is an ideal foundation for preparing attacks. Notably, in 2024, a tax service employee had already sold dossiers on wealthy digital asset owners, which triggered an increase in attacks from 1.9 to 4.6 cases per month.
Although the current leak contains no direct indications of cryptocurrency ownership, FrenchBreaches experts warn of a possible surge in targeted phishing. This echoes the case of Ledger co-founder David Balland, who was kidnapped in January 2025.
My analysis: This leak is a wake-up call for everyone holding significant assets in digital form. Even without direct ties to cryptocurrencies, the combination of financial data and addresses creates a dangerous precedent. I recommend that holders of large sums reconsider their physical security measures and be prepared for a wave of targeted phishing attacks.