Summary
- A breach at France’s tax authority has compromised data of 678,437 individuals and businesses.
- The leaked information includes income details, addresses, tax IDs, and family data.
- This information could enable criminals to execute targeted scams against affluent taxpayers and Bitcoin investors.
A significant data breach involving French tax records has put over 678,000 individuals and businesses, including Bitcoin holders, at risk of phishing schemes, identity theft, and other malicious attacks.
As reported by the French cybersecurity outlet FrenchBreaches, a hacker is attempting to sell these records, reportedly stolen from the French tax agency, the DGFiP, during a breach that occurred in June, for a price in the thousands of euros.
Myriad: Predict Bitcoin's next move. Make your prediction here.Jameson Loop, Chief Security Officer at Bitcoin security firm Casa, commented on X, stating, "This is more bad news for Bitcoiners in a country notorious for wrench attacks. The French tax authority has been hacked, and 678K records have been leaked."
According to FrenchBreaches, the compromised database includes data on 392,867 individuals and 285,570 professionals, with 26,805 of those having reported incomes exceeding $116,000, 386 with incomes above $1.16 million, and eight exceeding $11.6 million. The hacker is said to be offering access to this data for several thousand dollars.
Samples of the leaked information reportedly contain names, birth dates, home and email addresses, phone numbers, income levels, withholding tax rates, family status, and information about dependents.
In an update, FrenchBreaches noted, "The DGFiP has officially confirmed the breach of its information system." The hacker utilized stolen credentials in late June to access and extract taxpayer information, with the total number of affected individuals still under investigation.
FrenchBreaches explained that the attacker employed stolen VPN credentials and an internal search tool to acquire names, contact details, tax identifiers, income levels, withholding rates, and family data before authorities were able to cut off access.
They warned, "A scammer with genuine tax information who is aware of an old method used with the DGFiP could create a fraudulent message that appears far more credible than a generic fake email."
This data leak comes at a time when wrench attacks—violent incidents aimed at stealing cryptocurrency—are on the rise. In July, CertiK reported 52 such attacks globally in the first half of 2026, with 33 occurring in France alone. Chainalysis also reported 46 wrench attacks by June, with 30 in France, totaling over $30 million in stolen assets.
Chainalysis remarked, "Criminals have identified crypto holders as prime targets due to their possession of wealth that can be transferred instantly and irreversibly."