Massive data leak of French taxpayers: 678,000 records in the hands of a hacker
The French tax authority (DGFiP) has officially confirmed an unprecedented data breach: an attacker gained access to information about the income, addresses, and real estate of 678,000 taxpayers. This event will undoubtedly become one of the most high-profile cyber threats of the year in Europe.
Incident Details
The attack on DGFiP's information systems occurred between June and July 2026. Using compromised credentials of a tax office employee and an external contractor, the hacker penetrated internal servers via VPN. They managed to activate an automatic data export, which was only stopped by forcibly disabling access. Notably, an initial check after detecting suspicious activity revealed no signs of a breach—this indicates the attack's high complexity and sophistication.
The attacker obtained personal tax returns, including reference income, family quotient, and withholding rates, as well as corporate SIREN identifiers. The hacker also gained access to cadastral information: addresses and floor areas of real estate properties. However, DGFiP claims that login credentials for taxpayers' personal accounts were not stolen.
The incident became public on August 12, when a user under the pseudonym ZeroBytes put the database up for sale on a criminal forum. They claimed 678,438 rows of data, calling them only a portion of what was stolen. An analysis of the sample conducted by the resource FrenchBreaches showed that the database contains information on 392,867 individuals and 285,570 legal entities. Among the victims are 26,805 people with income exceeding €100,000, 386 with income over €1 million, and eight with income exceeding €10 million.
Threat to the Crypto Community
This incident raises particular concern in the context of the rise of so-called wrench attacks—violent assaults on cryptocurrency holders. According to Chainalysis, 30 such attacks were recorded in France in the first half of 2026, compared to only 19 throughout all of 2025. The cumulative global damage exceeded $30 million. The leak combined two key elements for preparing such crimes: the victim's income level and physical address. Analysts have identified precisely this data as the main catalyst for the surge in attacks.
The 2024 case is telling, when a tax office employee in the Paris region sold files on wealthy digital asset owners. After this case was made public in January 2026, the frequency of wrench attacks rose from 1.9 to 4.6 cases per month. Although the current leak contains no direct indications of cryptocurrency ownership, experts warn of a likely increase in targeted phishing.
My professional opinion: this leak is not just another case of data theft, but a systemic failure in the protection of critical state infrastructure. The combination of financial information with geolocation creates ideal conditions for real-world crimes that extend far beyond cyberspace. Digital asset owners in France and Europe should immediately reconsider their physical security protocols.