A hacker is selling a cache of French tax records that could leave more than 678,000 people and businesses exposed to phishing, identity theft, and targeted attacks, including Bitcoin holders, according to French cybersecurity outlet FrenchBreaches.
FrenchBreaches said the data was allegedly stolen from France’s tax authority, the Direction générale des Finances publiques, or DGFiP, during a breach in June. The file is reportedly being offered for several thousand euros.
Jameson Loop, chief security officer at Bitcoin security platform Casa, wrote on X: 「More bad news for Bitcoiners living in the leading country for wrench attacks. The French tax authority has been hacked, and 678K records leaked.」
FrenchBreaches said the database contains records on 392,867 individuals and 285,570 professionals. Within that set, 26,805 people had reference tax income of at least $116,000, 386 were above $1.16 million, and eight were above $11.6 million. The outlet also said the hacker was offering the file for several thousand dollars.
A sample of the leaked data reviewed by FrenchBreaches included names, birth details, home and email addresses, phone numbers, income figures, withholding tax rates, family status, dependents, and tax-share information.
DGFiP reportedly confirmed the intrusion
In an update, FrenchBreaches wrote: 「There DGFiP officially confirms the intrusion in its information system.」 The outlet added that stolen credentials were used in late June to access and extract taxpayer data, and that the number of people affected is still being investigated.
According to FrenchBreaches, the attacker used stolen VPN credentials and an internal search tool to pull names, contact details, tax identifiers, income figures, withholding rates, and family information before officials cut off access.
FrenchBreaches wrote: 「A scammer with real tax information and knowing of the existence of an old approach to the DGFiP could, for example, construct a fraudulent message that is much more credible than a simple fake generic email.」
Leak emerges as wrench attacks rise in France
FrenchBreaches focused on the data exposure itself, but the report comes as wrench attacks — crimes in which attackers use violence or threats to steal cryptocurrency — have been climbing.
CertiK said in July that 52 such attacks were recorded worldwide in the first half of 2026, including 33 in France. Earlier this month, Chainalysis said it had tracked 46 attacks through June, including 30 in France, with more than $30 million stolen.
Chainalysis wrote: 「Criminals have recognized that crypto holders are high-value targets because they possess wealth in an instantly and irreversibly transferable form.」