France’s tax administration has confirmed that hackers breached its information system, exposing sensitive financial and personal data belonging to hundreds of thousands of taxpayers and businesses — a leak that has prompted fresh warnings to Bitcoin holders in a country with a history of both data leaks and violent, crypto-targeted crime.

Bitcoin developer Jameson Lopp raised the alarm on X on Friday, describing the leak as “more bad news for Bitcoiners living in the leading country for wrench attacks.” Lopp has created a tracker counting wrench attacks — incidents in which physical violence is used to steal crypto — across the world; the tracker is maintained publicly on GitHub. A large number of them take place in France, where data has been leaked before, underscoring how personal information exposed in one breach can later be reused in scams or extortion attempts against identifiable targets.

More bad news for Bitcoiners living in the leading country for wrench attacks. The French tax authority has been hacked and 678K records leaked. 26,805 people with income over 100K€ 386 people with income over 1M€ 8 people with income over 10M€

— Jameson Lopp (@lopp) August 14, 2026

The news comes one day after hardware wallet manufacturer Trezor announced a data breach exposing customer data.

Cybersecurity researchers at FrenchBreaches, who reviewed samples of the leaked data, reported that the affected records break down to roughly 392,867 individuals and 285,570 businesses. Among the individuals, an estimated 26,805 have a reported annual taxable income of €100,000 or more, 386 exceed €1 million, and eight exceed €10 million. The hacker is said to be offering the full dataset for sale for several thousand euros.

The breach first surfaced publicly on August 12, when a hacker using the alias “ZeroBytes” posted on a cybercrime forum claiming to have infiltrated internal DGFiP servers and obtained VPN credentials that unlocked an internal lookup tool covering millions of taxpayers. According to the hacker’s own account, the extraction was interrupted before it could be completed, leaving what they described as only a partial dataset of 678,438 records.

The exposed sample reportedly includes highly sensitive information: full legal names, dates and places of birth, home and mailing addresses, marital status, number of dependents, internal tax identification numbers, reference taxable income, individual withholding tax rates, phone numbers, email addresses, and records of past correspondence with tax officials. For people who hold crypto or are publicly associated with it, that mix of identity and contact details can make impersonation attempts more credible even without access to wallets or passwords.

Security analysts warn that this combination of identity, contact and financial data could fuel highly convincing phishing campaigns impersonating tax authorities, as well as identity theft and fraud schemes tailored to victims’ income levels or family circumstances.

The leak comes after a record year for such crimes. 2025 was the worst on record for wrench attacks — crypto-targeted kidnappings — with around 55 reported globally last year, according to TRM Labs. Lopp’s tool counted over 70 throughout last year. This year is already looking bad, according to the tracker: 54 attacks have been documented so far.

Wrench attacks made headlines last year when criminals kidnapped David Balland, co-founder of crypto hardware wallet brand Ledger, and his wife in France. The pair was held for around 24 hours before they were rescued by the French authorities.

This post first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.