Key Takeaways:
A hacker is selling tax records tied to more than 678,000 French taxpayers and businesses, data that security researchers say could arm scammers targeting Bitcoin holders.
A hacker is selling personal and financial records tied to more than 678,000 French taxpayers and businesses, data that security researchers say could fuel phishing and targeted attacks against cryptocurrency holders.
"More bad news for Bitcoiners living in the leading country for wrench attacks," Jameson Loop, chief security officer at Bitcoin security platform Casa, said on X.
French cybersecurity outlet FrenchBreaches said the database contains records on 392,867 individuals and 285,570 professionals, including 26,805 people with reference tax income of at least $116,000, 386 above $1.16 million, and eight above $11.6 million. The hacker is reportedly offering the file for several thousand euros.
The leak comes as France records a surge in wrench attacks — physical assaults used to force victims to hand over crypto — with 30 of 46 attacks globally through June occurring in the country, according to Chainalysis.
The data was allegedly stolen from France's tax authority, the DGFiP, which runs impots.gouv.fr. FrenchBreaches said the attacker used stolen VPN credentials and an internal search tool in late June to extract names, contact details, tax identifiers, income figures, withholding rates, and family information before officials cut off access.
The DGFiP confirmed the intrusion in its information system, FrenchBreaches wrote in an update, adding that the number of people affected remains under investigation.
"A scammer with real tax information and knowing of the existence of an old approach to the DGFiP could, for example, construct a fraudulent message that is much more credible than a simple fake generic email," FrenchBreaches wrote.
The breach is the latest in a series of cyberattacks on French public institutions. In February, an attacker used stolen official credentials to access data linked to roughly 1.2 million bank accounts in the national FICOBA registry. In April, the National Agency for Secure Titles disclosed a breach exposing personal details from millions of records.
Wrench attacks on the rise
The data leak comes as wrench attacks — in which criminals use violence or threats to steal cryptocurrency — rise across France. In July, CertiK reported 52 attacks worldwide during the first half of 2026, including 33 in France. Earlier this month, Chainalysis reported 46 attacks through June, including 30 in France, with more than $30 million stolen.
"Criminals have recognized that crypto holders are high-value targets because they possess wealth in an instantly and irreversibly transferable form," Chainalysis wrote.
For French Bitcoin holders, the combination of detailed financial records and a documented pattern of physical attacks creates a heightened risk profile. The leaked data — which includes home addresses, income figures, and family status — gives criminals the information needed to identify high-net-worth targets and stage convincing social-engineering attacks, from fraudulent tax emails to doorstep confrontations. With the dataset already on sale, the window for affected taxpayers to secure accounts and harden personal security is narrow, and the DGFiP has not yet disclosed a timeline for notifying those impacted.
This article is for informational purposes only and does not constitute investment advice.
