The French tax authority (DGFiP) confirmed the theft of data from 678,000 taxpayers. The hacker stole information on incomes, as well as addresses and property sizes, the agency stated.
What Happened
The perpetrator attacked the DGFiP’s information system in June–July 2026, using credentials from a tax office employee and an external contractor. According to the hacker, they accessed internal servers, used a VPN to reach the search engine, and began an automated data extraction, which was only stopped by cutting off access.
The agency blocked the compromised accounts after detecting suspicious activity, but the leak was not discovered during the initial investigation. DGFiP attributed this to the complexity of the attack.
The hacker accessed personal tax data (reference income, family coefficient, withholding rate), as well as company names and SIREN numbers. Additionally, they viewed cadastral information—addresses and property sizes.
DGFiP emphasized that the hacker did not steal taxpayer account logins and passwords.
The incident came to light on August 12, when a user under the pseudonym ZeroBytes offered the database on a criminal forum for several thousand euros. They claimed to have extracted 678,438 rows, describing them as only part of the data obtained.
🚨 Le hacker de la DGFiP répond à Bercy. Alors que la DGFiP affirme que les espaces des usagers n’ont pas été compromis, il partage des captures montrant l’accès à des échanges fiscaux privés et revendique 6 366 056 demandes accessibles. pic.twitter.com/t78FryB18X
— Seb (@seblatombe) August 15, 2026
The specialized resource FrenchBreaches analyzed the sample released by the hacker and calculated: the database contains 392,867 individuals and 285,570 legal entities. Among individuals, 26,805 declared incomes over €100,000, 386 over €1 million, and eight over €10 million.
The same sample revealed taxpayer identifiers, birth dates and places, postal addresses, marital status, number of dependents, phone numbers, email addresses, and tax service contact history.
ZeroBytes claims to possess data on tens of millions of French citizens. However, DGFiP and independent checks have not yet confirmed this claim.
DGFiP has notified the CNIL, intends to contact law enforcement, and will inform affected individuals. The investigation is being conducted jointly with the SHFDS and the ANSSI. On August 15, the Paris prosecutor’s office launched its own investigation and involved the OFAC, according to CNews.
Implications for Cryptocurrency Holders
France remains a global center for wrench attacks—violent assaults on cryptocurrency holders. According to Chainalysis, 30 such attacks were recorded in the country in the first half of the year, compared to 19 for all of 2025. The total global damage has exceeded $30 million since the beginning of the year.
The latest leak combined two types of information that criminals use when preparing wrench attacks: the victim’s income level and physical address. Analysts have cited such information leaks as the main reason for the surge in attacks in France.
In 2024, a tax office employee in the Paris region was stealing and selling dossiers on wealthy digital asset owners to criminal intermediaries—complete with names, addresses, phone numbers, and asset volumes. Authorities disclosed this case in January 2026, and the frequency of wrench attacks subsequently rose from 1.9 cases per month to 4.6.
The new data leak does not contain information on cryptocurrency holdings. Neither DGFiP nor FrenchBreaches found indicators that would allow digital asset holders to be singled out among other taxpayers. However, FrenchBreaches warned of a potential spike in targeted phishing.
In January 2025, the co-founder of Ledger, David Balland, was kidnapped in France. He was released a day later, and law enforcement arrested 10 suspects.
