- Published on
France Tax Data Leak Could Fuel Scams, Attacks Targeting Bitcoin Holders
- Authors
- Name
- DeepHorus
France’s tax authority is reeling from a data breach that exposed the records of more than 678,000 people and businesses, including wealthy taxpayers and Bitcoin holders. The leaked information could fuel highly targeted phishing scams, identity theft, and even physical attacks against cryptocurrency owners, according to security researchers. The breach reportedly occurred in late June, and the data is now being sold online for several thousand euros.
French cybersecurity outlet FrenchBreaches first reported the incident, saying a hacker accessed the systems of the DGFiP, France’s tax authority, using stolen VPN credentials. The attacker used an internal search tool to extract a wide range of personal details before officials cut off access. DGFiP officially confirmed the intrusion, noting that the number of affected individuals remains under investigation.
The stolen database contains records on 392,867 individuals and 285,570 professionals. Among them, 26,805 people had reference tax income of at least $116,000, 386 earned more than $1.16 million, and eight had incomes above $11.6 million. The sample data includes names, birth dates, home and email addresses, phone numbers, income figures, withholding tax rates, family status, and tax-share information.
Security experts warn that this level of detail makes fraud much easier. “A scammer with real tax information could construct a fraudulent message that is much more credible than a simple fake generic email,” FrenchBreaches noted. Criminals could combine the leaked data with fake DGFiP messages to trick victims into revealing passwords or sending cryptocurrency.
The leak also raises concerns about wrench attacks, where criminals use threats or violence to force victims to hand over crypto. Bitcoin security executive Jameson Loop wrote on X: “More bad news for Bitcoiners living in the leading country for wrench attacks. The French tax authority has been hacked, and 678K records leaked.”
Recent figures show such attacks are rising. CertiK reported 52 wrench attacks worldwide in the first half of 2026, including 33 in France. Chainalysis documented 46 attacks through June, with 30 in France and more than $30 million stolen. Chainalysis noted that criminals see crypto holders as high-value targets because their wealth is instantly and irreversibly transferable.
The French data breach adds a new layer of risk for anyone holding digital assets. With detailed tax records now in the hands of criminals, authorities and individuals must remain vigilant against increasingly convincing scams and physical threats. The full scope of the leak is still being assessed, and further guidance from DGFiP is expected in the coming weeks.
