France’s tax authority confirmed a breach exposing roughly 678,000 taxpayer records. Security researchers see a direct threat in the fallout: the data gives attackers the address-and-income details that have driven a record streak of violent crypto robberies across the country.
The General Directorate of Public Finances, known as DGFiP, says the intrusion occurred in late June 2026. France’s Finance Minister confirmed it, Reuters reported. FrenchBreaches, a platform that tracks French cyberattacks, put the affected count at 678,437 people, about 1% of France’s population. The tax authority has not finalized that number. Its investigation continues.
The exposed records read like a kidnapping planner’s worksheet. FrenchBreaches reviewed leaked samples and found a sweeping haul: full legal names, dates and places of birth, home and mailing addresses, marital status, number of dependents, internal tax identification numbers, reference taxable income, withholding rates, phone numbers, email addresses, and records of past correspondence with tax officials, according to Bitcoin Magazine. Nearly 27,000 of the affected individuals reported income of at least €100,000. Of those, 386 reported more than €1 million. Eight reported over €10 million.
The hacker behind the breach used the moniker “ZeroBytes” and surfaced publicly on August 12. On a cybercrime forum, they posted that they had obtained VPN credentials to an internal DGFiP lookup tool covering millions of taxpayers. The extraction was interrupted before completion, according to the attacker’s own account. What came out is a partial dataset, now offered for sale on dark web marketplaces for several thousand euros. FrenchBreaches reviewed samples of the leaked data. The hacker’s broader access claims have not been independently verified.
Nowhere in the breach data is a flag for which taxpayers hold crypto. That distinction matters less than it sounds. The dataset pairs income tiers with home addresses, the two inputs most useful for targeting high-net-worth individuals. France is already, by available counts, the leading country for what the crypto community calls “wrench attacks”: violent physical assaults where criminals force holders to hand over funds.
The numbers bear that out. Chainalysis recorded 30 publicly known violent crypto attacks in France in the first half of 2026. Holders were robbed of more than $30 million, The Block reported. Keep that pace for a full year and 2026 surpasses the record $58 million stolen in 2025. TRM Labs counted roughly 55 such attacks globally last year. A tracker maintained by Bitcoin developer Jameson Lopp logged over 70, with 54 documented so far in 2026.
“More bad news for Bitcoiners living in the leading country for wrench attacks,” Lopp wrote on X on Friday.
This is not a single-incident story. Chainalysis linked part of the pattern to a separate case: a French tax employee accused of selling crypto investors’ confidential information to criminal organizations, beginning before her June 2025 arrest. Earlier this week, The Block reported that a couple in France’s Somme department was targeted three times in under a month after moving into a house formerly occupied by crypto millionaires whose tax information and address had appeared on the dark web. Last year, criminals kidnapped David Balland, co-founder of crypto hardware wallet brand Ledger, and his wife in France. The couple were held for roughly 24 hours before French authorities rescued them.
The DGFiP breach surfaced one day after hardware wallet manufacturer Trezor disclosed its own incident. A breach at its ShipMonk shipping provider compromised information on nearly 14,000 customers, including the phone numbers and addresses of 11,742 people. Security analysts warn the DGFiP data could fuel phishing campaigns impersonating tax authorities, identity theft, and fraud tailored to victims’ income levels and family circumstances.
What remains unknown is substantial. The confirmed final count of affected individuals. The precise breach vector beyond the ZeroBytes claim. Whether the intrusion has been linked to any new physical attack. The real identity of the attacker. DGFiP has not publicly confirmed the VPN-credential access route. Holders, as ever, are divided on how much a tax leak that does not name crypto owners actually changes their risk. The income tiers and addresses in that dataset do.
