A cyberattack on France’s tax authority has exposed personal and financial records belonging to roughly 678,000 people, and security researchers warn the leak could hand criminals a ready-made list of wealthy targets in a country already grappling with a wave of violent crime against crypto holders. The French crypto data breach concern stems less from the hack itself and more from what happens when stolen financial profiles collide with an already dangerous pattern of physical attacks on crypto owners across France.
Key takeaways
- Hackers breached France’s General Directorate of Public Finances in late June, exposing data tied to around 678,000 people, according to the French Finance Minister and breach-tracking platform FrenchBreaches.
- Leaked records reportedly include names, birthdates, home addresses, phone numbers, email addresses, and tax income figures.
- Nearly 27,000 affected individuals had incomes above €100,000, while 386 reported more than €1 million and eight exceeded €10 million.
- The stolen database is reportedly being sold on dark web marketplaces, and an attacker using the alias ZeroBytes claims responsibility.
- Chainalysis recorded 30 violent crypto attacks in France during the first half of 2026 alone, totaling more than $30 million stolen — putting the year on pace to beat 2025’s record.
Massive French tax data breach impacts nearly 678,000 people
France’s Finance Minister confirmed that a hacker infiltrated the General Directorate of Public Finances sometime in late June, pulling data tied to both individual and professional taxpayers. FrenchBreaches, a platform that tracks cyberattacks across the country, pegs the number at 678,437 people — roughly 1% of France’s entire population. That figure is still provisional, since the investigation into the scope of the intrusion remains ongoing.
The compromised records reportedly include names, birthdates, home addresses, phone numbers, email addresses, and tax income details. That combination turns what looks like a routine government data breach into something far more consequential: a detailed financial snapshot of hundreds of thousands of French residents, sitting in the hands of whoever pulled it out.
Attacker’s method and data exposure
The person behind the intrusion, using the alias ZeroBytes, claims to have exploited an internal search tool inside the tax agency’s systems to extract the records before administrators detected the breach and cut off access. It’s a detail that raises uncomfortable questions about how easily a single point of internal access can expose data belonging to hundreds of thousands of citizens.
Profile of exposed taxpayers highlights high-income individuals
What makes this incident different from a typical data leak is the income breakdown baked into the stolen records. Nearly 27,000 of the affected taxpayers reported income of at least €100,000, while 386 declared more than €1 million, and eight topped €10 million. That’s not just a privacy problem — it’s a curated list of people with the financial profile that makes them attractive to criminals running extortion, home invasion, or kidnapping schemes.
The breach doesn’t appear to directly identify which of these taxpayers own cryptocurrency. But that’s arguably beside the point. Anyone researching wealthy individuals in France now has a starting point that didn’t exist before this French tax data hack came to light.
Stolen taxpayer data is being sold on dark web marketplaces
The database is reportedly already for sale on dark web marketplaces, priced at several thousand euros, according to FrenchBreaches. Once financial and identity data reaches that stage, control over how it’s used effectively disappears. Buyers can cross-reference it against public records, social media, and other leaked datasets to build detailed profiles of specific individuals — exactly the kind of groundwork that precedes targeted attacks.
Surge in violent crypto wrench attacks in France in 2026
France has become one of the world’s worst hotspots for so-called wrench attacks, where criminals use violence or threats of violence to force crypto holders to hand over access to their funds. Blockchain analytics firm Chainalysis recorded 30 publicly known violent crypto attacks in the country during just the first half of 2026, with losses exceeding $30 million. That pace puts 2026 on track to surpass the $58 million stolen in violent crypto crimes across France in 2025 — already a record year.
Bitcoin security researcher Jameson Lopp, who has tracked physical attacks on crypto holders for nearly 12 years through one of the most extensive public databases on the subject, reacted to the tax breach bluntly on X: “More bad news for Bitcoiners living in the leading country for wrench attacks.”
Chainalysis has tied part of this trend to a separate and unrelated case: a French tax employee accused of selling crypto investors’ confidential information to criminal organizations, an operation that reportedly began before her arrest in June 2025. That case already demonstrated how insider access to tax records can feed directly into violent crime targeting crypto holders — a pattern this newer breach risks repeating at a much larger scale.
Why this matters for crypto holder security
The link between leaked financial data and physical danger isn’t theoretical in France anymore. Earlier this week, reports surfaced of a couple in France’s Somme department who were targeted three times in less than a month, simply because they had moved into a house previously occupied by crypto millionaires whose address and tax details had leaked onto the dark web. The attackers apparently didn’t know — or didn’t care — that the original occupants were long gone. That case underscores a chilling reality: once personal and financial data escapes into criminal networks, it can keep endangering people long after it becomes outdated, and even after it points to the wrong house.
Crypto holder security in France is increasingly shaped by data hygiene at institutions that have nothing to do with the crypto industry itself — tax agencies, shipping providers, government databases. Hardware wallet customers are feeling this too. Trezor disclosed that a breach at its shipping partner ShipMonk exposed information belonging to nearly 14,000 customers, including phone numbers and addresses for 11,742 people. None of that data came from Trezor’s own systems, yet the exposure still lands squarely on crypto users.
Taken together, these incidents point to a pattern that goes beyond any single breach: personal data leaking from unrelated institutions is steadily becoming raw material for violent crime targeting crypto holders in France, and each new leak adds another layer of risk to a threat that shows no sign of slowing down in 2026.
FAQ
What personal data was exposed in the French tax breach?
The breach exposed sensitive information including names, addresses, income, tax identifiers, phone numbers, and email addresses.
How many people were affected by the French tax data breach?
Approximately 678,000 individuals were affected, according to FrenchBreaches, a figure confirmed in general terms by the French Finance Minister, though the exact count remains under investigation.
What is a crypto wrench attack, and how is it linked to this breach?
A crypto wrench attack involves violence or threats used to coerce crypto holders into surrendering access to their funds. While the breach doesn’t directly identify crypto owners, the combination of income data and personal identities could help criminals identify wealthy targets, adding fuel to the surge in such attacks across France.
Who is the attacker behind the French tax data breach?
The attacker goes by the moniker ZeroBytes and reportedly used an internal search tool within the tax agency’s systems to extract the data before being discovered and cut off.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
Be the first to comment