French Tax Agency Breach Exposes 678,000 Records, Raising Fears of Targeted Attacks on Crypto Holders

France’s General Directorate of Public Finances has confirmed that unauthorized access to its information systems allowed the extraction of personal and financial records belonging to roughly 678,000 individuals and businesses. The incident, which occurred in June, has prompted warnings from security experts about elevated risks of physical violence against cryptocurrency holders in a country already facing a high volume of such crimes.

Details of the Intrusion

A hacker operating under the alias ZeroBytes claimed responsibility for the breach on a cybercrime forum. According to the claim and subsequent official statements, the attacker used compromised credentials tied to a tax agency employee and a third party to gain entry via an internal search tool and VPN access. The intrusion took place around late June, with data extraction interrupted before it could be completed.

The Directorate confirmed the unauthorized access after the public claim surfaced in mid-August. Officials stated that they had cut off the compromised accounts upon initial detection but did not immediately realize data had been stolen due to the sophistication of the methods used. Further investigation established that records on approximately 678,000 taxpayers and professionals had been consulted and extracted. The public-facing tax website and user accounts were not compromised.

Exposed information includes full names, dates and places of birth, home and mailing addresses, phone numbers, email addresses, marital status, number of dependents, internal tax identification numbers, reference taxable income, individual withholding tax rates, and records of past correspondence with tax authorities. Cadastral details relating to real estate addresses and property surfaces were also accessed in related activity.

Breakdowns of the data indicate roughly 392,867 individuals and 285,570 businesses were affected. Among the individuals, an estimated 26,805 reported annual taxable income exceeding 100,000 euros, 386 exceeded 1 million euros, and eight exceeded 10 million euros. The partial dataset has been offered for sale on underground forums for several thousand euros.

The agency said it has notified France’s data protection authority, implemented additional security restrictions, and plans to contact each affected person or entity directly in the coming days by email or post. Those notices will specify the data that may have been accessed and outline recommended vigilance measures.

Heightened Concerns for Cryptocurrency Investors

Security analysts and industry figures have linked the leak to increased dangers for people holding digital assets in France. The country has recorded a disproportionate share of violent incidents in which attackers use physical force, home invasions, or kidnappings to compel victims to transfer cryptocurrency. These crimes are commonly referred to as wrench attacks.

Jameson Lopp, a security analyst and chief security officer at Casa Wallet, described the breach as additional bad news for Bitcoin holders living in the leading country for such attacks. He noted the presence of more than 26,000 records involving incomes above 100,000 euros and hundreds involving incomes above 1 million euros.

Curve founder Michael Egorov reacted to the news by questioning whether paying taxes had itself become a source of physical risk.

Alexandre Stachtchenko, head of strategy and communications at Bitstack, called for a halt to further personal data collection by state institutions until proper safeguards are in place, arguing that current practices have placed taxpayers in danger.

Reports from blockchain analytics firms and independent trackers place France at the top of global rankings for these violent incidents in 2026. One analysis counted dozens of cases in the country, with total losses across tracked attacks reaching tens of millions of dollars. High-profile cases in recent years have included the kidnapping of a Ledger co-founder and his wife, who were later rescued, and a home invasion targeting the chief executive of Binance France.

Security researchers note that the combination of precise income figures, home addresses, and contact details creates fertile ground for both sophisticated phishing schemes impersonating tax authorities and physical targeting of high-net-worth individuals. Crypto holders whose records appear in the leaked set have been advised to heighten personal security measures.

Official Response and Ongoing Investigation

The Directorate stressed that it acted quickly to sever unauthorized access and has strengthened controls to prevent recurrence. Investigations continue with support from national cybersecurity authorities to determine the full scope of data involved. Officials apologized to those affected and committed to providing individualized information and guidance.

The breach adds to a series of data exposures affecting French institutions and crypto-related services this year. While the tax agency maintains that core online services remain secure, the availability of detailed financial profiles on the open market has intensified scrutiny of how public authorities protect sensitive taxpayer information.