Massive data leak from France's tax authority: 678,000 taxpayers at risk
The French tax authority (DGFiP) has officially confirmed a major cyberattack that resulted in the theft of personal data belonging to 678,000 taxpayers. The attacker gained access to information about citizens' incomes, their addresses, and characteristics of their real estate properties. In my view, this event is one of the most serious incidents in the field of financial security in Europe in recent years.
Incident Details
The attack was carried out between June and July 2026. The hacker used compromised credentials belonging to a DGFiP employee and an external contractor. After penetrating the internal network via VPN, they gained access to search tools and launched an automated data export. The process was only halted by completely disabling access to the system.
Notably, an initial check after account blocking revealed no traces of the leak — the agency attributes this to the high complexity and sophistication of the attack. The stolen data includes individual tax returns (income, family quotient, withholding rates), as well as corporate SIREN identifiers. Additionally, the attacker gained access to cadastral information: addresses and floor areas of real estate properties.
It is important to note that taxpayers' personal accounts, their logins, and passwords were not compromised. However, on August 12, a user under the pseudonym ZeroBytes listed the database for sale on a criminal forum for several thousand euros, claiming 678,438 rows and hinting that this was only a small portion of what was stolen.
Analysis of the Leak and Risks for the Crypto Community
Independent experts from FrenchBreaches examined a sample of the data and found not only tax information but also taxpayer identifiers, dates of birth, marital status, contact details, and history of interactions with the tax service. Among the victims are 26,805 people with incomes exceeding €100,000, 386 with incomes over €1 million, and eight with incomes exceeding €10 million.
This incident is particularly alarming for cryptocurrency holders. France has long been an epicenter of so-called wrench attacks — violent assaults aimed at forcing victims to transfer digital assets. According to Chainalysis, 30 such attacks were recorded in the country in the first half of 2026 alone, with global losses exceeding $30 million. The leak combined two key elements for preparing such crimes: the victim's income level and physical address.
Although the stolen data contains no direct information about cryptocurrency ownership, analysts warn of a possible surge in targeted phishing. French authorities have already notified CNIL, launched an investigation jointly with ANSSI and SHFDS, and the Paris prosecutor's office has brought OFAC into the case.
My comment: This leak is yet another reminder that even the most protected government systems are vulnerable. For crypto asset holders, this is a signal to immediately strengthen personal security: physical protection, the use of multi-signature wallets, and minimizing the public linkage of addresses to real identities are becoming not a recommendation but a strict necessity. The situation in France demonstrates that offline threats are evolving faster than protective measures.