France Tax Data Leak Threatens Bitcoin Holders

A hacker has put up for sale a database from France's tax authority DGFiP containing information on more than 678,000 taxpayers and businesses. The attacker gained access to the system back in June using stolen VPN credentials. Cybersecurity researchers warn the leak could become a tool for fraud and physical attacks on Bitcoin holders.

Hacker Sells France Tax Authority Data

The sale was reported by French cybersecurity outlet FrenchBreaches. According to the report, the attacker broke into the DGFiP system (Direction generale des Finances publiques, France's main tax authority) in late June, using stolen VPN credentials and an internal search tool normally available only to tax service staff. The file with the records went on sale for several thousand dollars on a hacking forum.

DGFiP officially confirmed the intrusion into its information system. The agency said the access and extraction of taxpayer data took place in late June, and the exact scope of affected people is still being determined. Access was cut off as soon as the breach was detected, but the file had already reached the black market. It remains unclear whether investigators have identified the attacker.

DGFiP administers taxes for more than 68 million French residents, so even partial access to the agency's internal systems theoretically opens up a massive pool of personal data to an attacker. The sheer size of the agency is what makes this kind of breach especially sensitive for national cybersecurity.

Scale and Contents of the Leak

According to the outlet, the database holds records on 392,867 individuals and 285,570 businesses. Among them, 26,805 people declared a so-called reference tax income above $116,000, a figure the French tax system uses to determine eligibility for benefits and subsidies. Another 386 people declared more than $1.16 million. Several thousand dollars for a database of this size is a typical price for leaked government archives on shadow forums, where such files are usually resold to several buyers at once.

A sample of the leaked data reviewed by journalists included:

• names, birth dates and home addresses
• phone numbers and email addresses
• income figures and withholding tax rates
• family status, number of dependents and household tax-share data

Precise income figures and home addresses from the DGFiP leak could theoretically help criminals pick targets for fraud. FrenchBreaches warns that this kind of dataset lets scammers craft a convincing phishing message posing as the tax authority, far more believable than a generic fake email. Such messages typically include exact figures from the victim's own tax return, which lowers suspicion even among cautious people.

Risk for Bitcoin Holders

Jameson Loop, Chief Security Officer at Casa, a US company that builds Bitcoin self-custody tools, wrote on X that the leak is bad news specifically for Bitcoin holders in France. He noted the country leads in so-called wrench attacks. The term describes physical violence or threats used to force a victim to transfer cryptocurrency under duress or after being kidnapped.

"More bad news for Bitcoiners living in the leading country for wrench attacks. The French tax authority has been hacked, and 678K records leaked."

- Jameson Loop, Chief Security Officer at Casa, from a post on X

CertiK counted 52 such attacks worldwide in the first half of 2026, with 33 of them in France. Chainalysis tracked 46 attacks through June, 30 of them also French, with combined losses above $30 million. The firm's analysts attribute this concentration partly to crypto holders publicly disclosing their wealth on social media or at public events. Unlike an exchange or smart contract hack, a wrench attack requires no technical skill: the attacker just needs to know who holds crypto and where that person lives.

Bitcoin holders with large balances are traditionally warned against publicly mentioning the size of their portfolio. Security specialists recommend moving most funds to hardware wallets like Ledger or Trezor, which stay offline and don't depend on personal data leaks. Some holders also split funds across several wallets to reduce the risk of losing everything at once. More experienced investors also use multisig wallets or digital asset insurance, though such solutions remain niche even among large Bitcoin holders.

Investigation Continues

DGFiP has not given an exact date for when the review of the leak's scope will end. The investigation into the source of the breach is also ongoing. Since the data concerns EU citizens, the agency is expected to also report the incident to France's data protection regulator CNIL under GDPR requirements.

Until the review wraps up, FrenchBreaches advises anyone whose data might be in the database to be more careful with letters and calls claiming to be from the tax authority, and to verify any requests only through DGFiP's official channels. Experts recommend extra caution for anyone who has publicly mentioned holding cryptocurrency. Other European government bodies have reported similar leaks in recent years, gradually turning the protection of taxpayer data into a distinct cybersecurity problem for governments. Regardless of balance size, experts also recommend enabling two-factor authentication on all financial accounts, since stolen personal data is often used to bypass basic identity checks.