In brief
- A reported breach of Frances tax authority exposed data tied to 678,437 people and businesses.
- The records allegedly include income figures, addresses, tax identifiers, and family information.
- The data could help criminals craft targeted scams against wealthy taxpayers and Bitcoin holders.
A hacker is selling a trove of French tax records that could expose more than 678,000 people and businesses, including Bitcoin holders, to phishing, identity theft, and targeted attacks.
According to a report by French cybersecurity outlet FrenchBreaches, a hacker is selling records allegedly stolen from Frances tax authority, the DGFiP, during a June breach for several thousand euros.
Myriad: Bitcoin's next move？ Click to make your prediction.
“More bad news for Bitcoiners living in the leading country for wrench attacks,” Chief Security Officer at Bitcoin security platform Casa Jameson Loop wrote on X. “The French tax authority has been hacked, and 678K records leaked.”
FrenchBreaches said the database contains records on 392,867 individuals and 285,570 professionals, including 26,805 people with reference tax income of at least $116,000, 386 above $1.16 million, and eight above $11.6 million; the hacker is reportedly offering the file for several thousand dollars.
FrenchBreaches said a sample of the leaked data included names, birth details, home and email addresses, phone numbers, income figures, withholding tax rates, family status, dependents, and tax-share information.
“There DGFiP officially confirms the intrusion in its information system,” FrenchBreaches wrote in an update. Stolen credentials were used in late June to access and extract taxpayer data, and the number of people affected remains under investigation, the firm added.
According to FrenchBreaches, the attacker used stolen VPN credentials and an internal search tool to extract names, contact details, tax identifiers, income figures, withholding rates, and family information before officials cut off access.
“A scammer with real tax information and knowing of the existence of an old approach to the DGFiP could, for example, construct a fraudulent message that is much more credible than a simple fake generic email,” FrenchBreaches wrote.
While the FrenchBreaches report focused on the data leak, it comes amid a rise in wrench attacks, in which criminals use violence or threats to steal cryptocurrency.
In July, CertiK reported 52 attacks worldwide during the first half of 2026, including 33 in France. Earlier this month, Chainalysis reported 46 attacks through June, including 30 in France, with more than $30 million stolen.
“Criminals have recognized that crypto holders are high-value targets because they possess wealth in an instantly and irreversibly transferable form,” Chainalysis wrote.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Your Email
Get it!
Get it!