Data leak of 678,000 French taxpayers: a hidden threat for cryptocurrency holders
A large-scale incident in the information system of France's General Directorate of Public Finance (DGFiP) has drawn my attention not only as an analyst but also as a cybersecurity specialist. The agency has officially confirmed unauthorized access to the personal data of 678,000 taxpayers. The attacker gained access to declared income, addresses, and cadastral data on real estate.
Timeline of the attack
The attack was carried out between June and July 2026. The attacker used compromised credentials belonging to a DGFiP employee and an external contractor. After penetrating the internal network via VPN, they gained access to search tools and launched an automated data extraction. The process was only halted by completely disabling access.
Notably, an initial check after account lockdowns revealed no traces of a leak—this indicates a high level of technical sophistication in the attack. The hacker obtained tax data on individuals (reference income, family coefficient, withholding rate), as well as SIREN identifiers of companies and cadastral information.
What is known about the stolen data
The incident became public on August 12, when a user under the pseudonym ZeroBytes put the database up for sale on a criminal forum for several thousand euros. The specialized resource FrenchBreaches conducted an independent analysis of the posted sample. According to their estimates, the database contains data on 392,867 individuals and 285,570 legal entities. Among the individuals, 26,805 people declared income exceeding €100,000, 386—more than €1 million, and eight—over €10 million.
In addition to financial indicators, the sample contains taxpayer identifiers, dates and places of birth, postal addresses, marital status, phone numbers, email addresses, and history of contacts with the tax service. ZeroBytes claims to possess data on tens of millions of citizens, but this statement has not yet been officially confirmed.
Direct threat to the crypto community
Here, I want to draw special attention to a worrying trend. France remains the epicenter of so-called wrench attacks—violent assaults on cryptocurrency holders. According to Chainalysis, in the first half of 2026 alone, the country recorded 30 such incidents, compared to 19 for all of 2025. The total global damage exceeded $30 million.
The current leak has combined two critical components for preparing such attacks: the victim's income level and their physical address. This is exactly the set of data that analysts have called the main catalyst for the rise in attacks. In 2024, a tax office employee in the Paris region had already stolen files on wealthy digital asset owners, leading to an increase in attack frequency from 1.9 to 4.6 cases per month.
The new leak contains no direct indications of cryptocurrency ownership, but the risk of targeted phishing and physical attacks remains high. Digital asset holders in France should reconsider their security measures, especially regarding the disclosure of personal information.
My expert conclusion: Tax data leaks are becoming a systemic problem that directly affects the physical security of crypto investors. The combination of financial information with residential addresses is a ready-made dossier for criminal groups. I recommend that anyone falling into the category of wealthy taxpayers take additional precautions, up to changing registration addresses and strengthening physical security.