France's largest tax data leak: 678,000 taxpayers at risk
The French tax authority (DGFiP) has officially confirmed a large-scale incident in which an attacker gained access to the personal data of more than 678,000 taxpayers. The attack affected information about citizens' income, addresses, and property characteristics — making it one of the most serious compromises of state systems in the country's history.
Attack details
The breach occurred in June-July 2026 through compromised credentials of a DGFiP employee and an external contractor. The hacker, operating via VPN, gained access to internal search systems and launched an automated data extraction. Notably, the agency's initial review did not reveal signs of intrusion — the attack's sophistication allowed the attacker to operate undetected.
During the incident, individual tax returns (including reference income, family coefficient, and withholding rates) were stolen, along with corporate SIREN identifiers. Additionally, the hacker gained access to cadastral records with addresses and floor areas of real estate properties. It is important to note that login credentials for taxpayer personal accounts were not compromised.
Scope and consequences
The incident became public on August 12, when a user under the pseudonym ZeroBytes put the database up for sale on a criminal forum. An analysis of the data sample conducted by the specialized resource FrenchBreaches showed that the database contains 392,867 individuals and 285,570 legal entities. Among the victims are 26,805 people with income exceeding €100,000, 386 taxpayers with income over €1 million, and eight individuals who declared more than €10 million.
The leaked data also includes taxpayer identifiers, dates and places of birth, marital status, number of dependents, contact details, and history of communications with the tax authority. ZeroBytes claims to possess information on tens of millions of citizens, but official checks have not yet confirmed these statements.
Threat to cryptocurrency holders
This incident raises particular concern in the context of the rise in violent crimes against owners of digital assets. France has already become the epicenter of so-called wrench attacks — assaults using physical force to coerce the transfer of crypto assets. According to Chainalysis, in the first half of 2026, 30 such attacks were recorded in the country, compared to 19 for all of 2025, with global cumulative damages exceeding $30 million.
The leak combined two critical types of data: the victim's income level and physical address. These are precisely the details criminals use when preparing attacks. Notably, in 2024, a tax authority employee had already sold files on wealthy cryptocurrency owners, leading to an increase in attack frequency from 1.9 to 4.6 cases per month.
Although the new leak contains no direct indications of cryptocurrency ownership, experts warn of a possible surge in targeted phishing. DGFiP has already notified CNIL and plans to contact law enforcement, while the Paris prosecutor's office has launched its own investigation.
My analysis: This incident is yet another reminder that government databases remain a weak link in the digital asset ecosystem. Even if cryptocurrencies are not mentioned directly, the combination of financial information and addresses creates an ideal map for targeted attacks. Owners of significant amounts of digital assets should reconsider their physical security measures, especially in France, where this threat has already become systemic.