French Tax Records Breach Exposes Hundreds of Thousands to Fraud and Crypto Theft Attacks

Major French Tax Authority Breach Exposes Hundreds of Thousands

Cybercriminals have obtained a substantial database of personal and financial information belonging to over 678,000 French taxpayers and business professionals. According to FrenchBreaches, a French cybersecurity research firm, an attacker accessed confidential records from France’s tax authority, the DGFiP, during a breach in June. The hacker is now attempting to sell these records for several thousand euros on underground markets.

The compromised dataset includes information on 392,867 individuals and 285,570 business professionals. Within this pool, approximately 26,805 individuals are recorded as having reference tax income of at least $116,000, while 386 report incomes exceeding $1.16 million, and eight exceed $11.6 million. The stolen information encompasses names, birth dates, residential and email addresses, telephone numbers, income statements, withholding tax rates, family status, dependent information, and tax identification numbers.

How Attackers Exploited the Breach and Crafted Convincing Scams

FrenchBreaches revealed that the attacker leveraged stolen VPN credentials combined with internal search tools to systematically access and extract sensitive taxpayer information. The intrusion occurred in late June before officials identified and blocked further access; however, the attacker had already compiled and exfiltrated the complete records. The DGFiP has officially confirmed the intrusion, though investigations into the full scope of affected individuals remain ongoing.

Security researchers at FrenchBreaches emphasized a particularly dangerous consequence: criminals armed with authentic tax data can now construct vastly more persuasive fraudulent communications. A scammer possessing legitimate tax authority information could craft messages impersonating the DGFiP with significantly higher credibility than generic phishing emails, substantially increasing the likelihood that targeted taxpayers fall victim to identity theft and financial fraud.

Escalating Threat Landscape for Crypto Holders

The tax records leak arrives during a documented surge in violent cryptocurrency theft campaigns specifically targeting France. These incidents, known as wrench attacks, involve criminals using violence or threats to coerce victims into transferring their digital assets. During the first half of 2026, CertiK documented 52 such attacks globally, with 33 occurring in France alone. Chainalysis reported similar trends, tracking 46 wrench attacks through June, including 30 in France, resulting in thefts exceeding $30 million.

Casa’s Chief Security Officer Jameson Loop flagged the compounded risk facing French Bitcoin holders. The leaked tax records identify wealthy individuals who represent high-value targets for criminals. Chainalysis has noted that criminals increasingly view cryptocurrency holders as prime targets, given that digital assets represent instantly transferable and irreversible wealth compared to traditional financial holdings.

For crypto investors in France, the convergence of leaked personal financial data and rising physical theft campaigns creates a dual-layered vulnerability—one digital through targeted fraud, the other physical through organized wrench attacks.

Source: FrenchBreaches, via Decrypt. Not financial advice.