The French tax authority (DGFiP) has confirmed that the personal information of 678,000 taxpayers has been compromised. The hacker accessed income details, property addresses, and sizes, according to the agency.
Incident Details
The breach occurred between June and July 2026, when the perpetrator exploited credentials from a tax office employee and an external contractor. Claiming to have infiltrated internal servers, the hacker utilized a VPN to access the search engine and initiated an automated data extraction that could only be halted by cutting off access.
Upon detecting suspicious activity, the agency disabled the compromised accounts, but an initial investigation did not reveal the data breach, which DGFiP attributed to the complexity of the attack.
The hacker accessed sensitive information, including individual tax data (reference income, family coefficient, withholding tax rates) and details about companies such as names and SIREN numbers. Additionally, the hacker viewed cadastral information, including property addresses and sizes.
DGFiP emphasized that the hacker did not obtain taxpayer account details, including usernames and passwords.
Details of the breach surfaced on August 12, when a user known as ZeroBytes advertised the database on a criminal forum for several thousand euros. They claimed to have extracted 678,438 records, stating it was only a portion of the total data obtained.
šØ The DGFiP hacker responds to Bercy. While the DGFiP asserts that user accounts were not compromised, he shared screenshots showing access to private tax exchanges and claims to have 6,366,056 requests available. pic.twitter.com/t78FryB18X
ā Seb (@seblatombe) August 15, 2026
The specialized site FrenchBreaches analyzed the sample shared by the hacker and found that the database includes data on 392,867 individuals and 285,570 legal entities. Among the individuals, 26,805 reported incomes exceeding ā¬100,000, while 386 declared incomes over ā¬1 million, and eight reported more than ā¬10 million.
The same sample revealed taxpayer identifiers, birth dates and places, mailing addresses, marital statuses, number of dependents, phone numbers, email addresses, and communication history with the tax authority.
ZeroBytes claims to have information on tens of millions of French citizens, though DGFiP and independent investigations have yet to validate this assertion.
The DGFiP has notified the CNIL, plans to reach out to law enforcement, and will inform those affected. An investigation is underway with SHFDS and ANSSI, while the Paris prosecutor's office has initiated its own inquiry and involved OFAC, according to CNews.
Implications for Cryptocurrency Holders
France continues to be a hotspot for wrench attacksāviolent assaults targeting cryptocurrency holders. According to Chainalysis, the country recorded 30 such incidents in the first half of the year, compared to 19 for all of 2025. The total damage worldwide has surpassed $30 million since the start of the year.
Source: Chainalysis.This recent data leak merges two critical types of information that criminals exploit for wrench attacks: victims' income levels and physical addresses. Analysts have identified such leaks as a primary cause for the rise in attacks in France.
In 2024, a tax office employee in the Paris region was implicated in stealing and selling files on affluent digital asset ownersācontaining names, addresses, phone numbers, and asset volumes. Authorities disclosed this case in January 2026, after which the frequency of wrench attacks surged from 1.9 incidents per month to 4.6.
The new leak does not include any information on cryptocurrency holdings. Neither DGFiP nor FrenchBreaches have found evidence to identify cryptocurrency holders among the affected taxpayers. However, FrenchBreaches warned of a potential increase in targeted phishing scams.
It is worth noting that in January 2025, the co-founder of Ledger, David Balland, was kidnapped in France. He was released the next day, and law enforcement apprehended ten suspects.