In France, data of 678,000 taxpayers has been stolen: a new threat for the crypto community
A large-scale incident has come to light in France's financial system: the Directorate General of Public Finance (DGFiP) has confirmed unauthorized access to the personal data of more than half a million taxpayers. During the attack, the perpetrator gained access to information about citizens' income, addresses, and property characteristics.
Details of the cyberattack
The breach of the agency's information systems occurred between June and July 2026. Using compromised credentials of a DGFiP employee and an external contractor, the hacker gained access to internal search tools via a VPN connection and launched an automated data extraction. The process was only halted after forced access termination.
Notably, an initial review of suspicious activity did not reveal signs of a leak—the agency attributed this to the high sophistication of the attack. The attacker obtained not only tax returns (reference income, family quotient, withholding rates) but also cadastral information, including exact addresses and floor areas of real estate properties.
Disclosure and scope of the leak
The incident became public on August 12, when a user under the pseudonym ZeroBytes put the database up for sale on a criminal forum for several thousand euros. An analysis of the posted sample, conducted by the specialized resource FrenchBreaches, showed that the database contains data on 392,867 individuals and 285,570 legal entities. Among the victims are 26,805 people with declared income exceeding €100,000, 386 people with income over €1 million, and eight with income exceeding €10 million.
In addition to financial indicators, the leak includes taxpayer identifiers, dates and places of birth, postal addresses, marital status, phone numbers, email addresses, and history of inquiries to the tax service. The attacker claims to possess data on tens of millions of citizens, but official checks have not yet confirmed these statements.
Direct threat to cryptocurrency holders
This incident poses a particular danger to the crypto community. France remains the global epicenter of so-called wrench attacks—violent assaults on digital asset owners. According to analysts, 30 such attacks were recorded in the country in the first half of 2026, compared to 19 for the entire previous year, with total damages exceeding $30 million.
The key issue is that the leak combined two critical types of data that criminals use to prepare attacks: the victim's income level and physical address. Analysts have cited precisely such leaks as the main catalyst for the surge in violent crimes in France. The situation is compounded by the 2024 precedent, when a tax office employee sold files on wealthy crypto asset owners to criminal intermediaries—after this case was made public, the frequency of attacks rose from 1.9 to 4.6 cases per month.
Although the current leak contains no direct indications of cryptocurrency ownership, experts warn of a likely increase in targeted phishing. DGFiP has already notified CNIL and is preparing a referral to law enforcement agencies, while the Paris prosecutor's office has launched its own investigation.
My comment: The situation in France demonstrates an alarming trend—cybercrime is increasingly intertwined with physical threats. Holders of large sums in digital assets should reconsider their security measures and avoid publicly linking residential addresses to financial activity.