In France, data of 678,000 taxpayers has been stolen: a new threat for cryptocurrency holders
The French tax authority (DGFiP) has officially confirmed a massive leak of confidential information about 678,000 taxpayers. As a result of the attack, the attacker gained access to income data, as well as addresses and property sizes of citizens. This event, in my view, is not just another cybersecurity incident, but a warning signal for the entire crypto community.
Incident Details
The attack on DGFiP's information systems occurred between June and July 2026. The attacker used compromised credentials of a tax service employee and an external contractor. After penetrating internal servers via VPN, they launched an automated data extraction that was only stopped by forcibly disabling access. Notably, an initial check after account blocking revealed no signs of a breach, indicating the high complexity and sophistication of the attack.
During the incident, individual tax returns were stolen, including reference income, family quotient, and withholding tax rates. Additionally, the attacker gained access to company names and SIREN identification numbers, as well as cadastral information—addresses and sizes of real estate properties. It is important to note that taxpayers' personal accounts, their logins, and passwords were not compromised.
Disclosure and Scope of the Leak
The incident became known on August 12, when a user under the pseudonym ZeroBytes put the database up for sale on a criminal forum for several thousand euros. According to the hacker, they extracted 678,438 rows, but this is only a small part of the obtained information. An analysis conducted by the specialized resource FrenchBreaches showed that the database contains data on 392,867 individuals and 285,570 legal entities. Among them, 26,805 people declared income over €100,000, 386—over €1 million, and eight—over €10 million.
In addition to financial indicators, the leak contains taxpayer identifiers, dates and places of birth, postal addresses, marital status, phone numbers, email addresses, and history of inquiries to the tax service. ZeroBytes claims to possess data on tens of millions of French citizens, but these statements have not yet been officially confirmed.
Threat to Cryptocurrency Holders
Of particular concern is the fact that France remains the epicenter of so-called wrench attacks—violent assaults on digital asset owners. According to Chainalysis, 30 such incidents were recorded in the country in the first half of 2026, compared to just 19 for all of 2025. The total damage from such attacks worldwide has exceeded $30 million since the beginning of the year.
The latest leak combined two critically important types of data that criminals use when preparing attacks: the victim's income level and their physical address. Analysts have already called such leaks the main cause of the surge in wrench attacks in France. In 2024, a tax service employee in the Paris region stole and sold files on wealthy cryptocurrency asset owners to criminal intermediaries. After this case was made public in January 2026, the frequency of attacks increased from 1.9 to 4.6 cases per month.
Although the new data contains no direct indications of cryptocurrency ownership, FrenchBreaches experts warn of a possible surge in targeted phishing. I recall that in January 2025, Ledger co-founder David Balland was kidnapped in France and released within a day.
My professional commentary: This leak is a vivid example of how traditional financial data becomes a tool for offline crimes. Cryptocurrency holders in France and Europe should immediately reconsider their security measures, especially if their incomes and addresses could have entered the public domain. I recommend minimizing public disclosure of information about your assets and considering the use of identity protection services.