A hacker is marketing tax details covering more than 678,000 French individuals and companies, exposing a trove of personal and financial data that could be used for phishing, identity theft, and the targeting of Bitcoin holders.

Identifiable information such as names, addresses, and income figures can make a generic scam seem legitimate enough to appear as if it comes from a bank, an exchange, a tax office, or a police department. Chainalysis estimates that criminals earned a minimum of $17 billion from crypto scams and fraud in 2025, with impersonation scams increasing in size by more than 1,400% over the same year.

What the hacker is selling

French cybersecurity outlet FrenchBreaches, which first reported the sale, said the data came from France's tax authority, the DGFiP. According to the outlet, the file covers 392,867 individuals and 285,570 professionals. A sample included names, addresses, phone numbers, income figures, and family information.

The sample appeared to indicate potential targets. FrenchBreaches noted a total of 26,805 individuals with a reported reference income of at least $116,000, 386 with a reference income of more than $1.16 million, and eight with a reference income exceeding $11.6 million.

France's Finance Ministry has acknowledged that a hacking incident took place, disclosing that the hackers employed stolen VPN credentials to access one of the agency's internal search tools towards the end of June. The hackers' access to the system was cut only during a "routine check", and the data theft itself was not uncovered at that point. According to Cryptopolitan, the incident affected 678,000 users, and personal notifications are set to be sent soon. However, the full scale of the incident is still being established.

Why Bitcoin holders are at the sharp end

Bitcoin security advocate Jameson Lopp warned that the breach is particularly concerning in France, which he described as the leading country for "wrench attacks" — physical robberies in which victims are coerced into handing over cryptocurrency. He noted that the leaked dataset includes 26,805 people earning more than €100,000 and 386 earning more than €1 million.

More bad news for Bitcoiners living in the leading country for wrench attacks. The French tax authority has been hacked and 678K records leaked. 26,805 people with income over 100K€ 386 people with income over 1M€ 8 people with income over 10M€ — Jameson Lopp (@lopp) August 14, 2026

Lopp had already raised concerns about France's crypto-targeting problem in January 2026, when he commented on a separate case involving a French tax official allegedly using privileged access to identify cryptocurrency owners. Now, a DGFiP breach has exposed detailed taxpayer information. The two incidents should not be portrayed as connected, but the security concern is clearly related.

CertiK's data corroborates Lopp's statement. The blockchain security company recorded 52 cases of verified wrench attacks globally in the first half of 2026, of which 33 took place in France. France therefore represents 63.5% of CertiK's dataset, making it the largest national hub. According to CertiK, factors behind the high concentration of wrench attacks in France include the country's sizable crypto industry, notorious business leaders, publicly displayed extravagance, and the incidence of sensitive data breaches.

Because of this, the leak is bigger than just a privacy violation. A comprehensive database can help criminals skip the reconnaissance they would otherwise need to carry out on their own: names tell them whom they are dealing with, an address reveals where to look, and income information shows whether the target is worth pursuing. In practice, that means a breach of tax records can support not only digital impersonation but also more targeted offline intimidation, which is why the exposure matters beyond the immediate theft of personal data.

CertiK refers to this process as "data-driven targeting", meaning the combination of leaked information with social media, blockchain activity, and public information.

France has already learned what it means to experience crypto-crime transitioning from the digital sphere into physical reality. Cybermalveillance.gouv.fr has reported on fraudsters who pretend to be employees of crypto platforms, banking fraud teams, and law enforcement bodies in order to convince people to remit funds or give away sensitive data. Law enforcement agencies have faced cases of threats, physical abuse, and abductions.

Security features alone, however, are not enough. Holders of high-value assets can reduce their exposure by avoiding publicly disclosing personal details, splitting important funds among various wallets, using multiple signatures, and storing sensitive recovery data in secure places. Any person whose information may have been involved in a breach must expect that a future fraud attempt will involve accurate details about them — and can therefore be very convincing.

A pattern regulators are chasing

The breach comes as France faces wider data-security problems. CNIL, France's data protection authority, has made cybersecurity a major enforcement priority for 2026.

Regulatory measures cannot, however, erase information after it has already been duplicated and sold. This is particularly important for users of cryptocurrencies, because once cryptocurrencies have been transacted, there is no turning back. That limitation makes prevention and careful verification especially important when stolen personal details can be used to make a message, phone call, or request appear routine.

ADAN reports that about 11% of people in France own cryptocurrencies, which represents a huge group of possible victims.

The leak does not imply that all holders of cryptocurrency in France face a physical risk, or that hackers will use the information to carry out a direct attack. But CertiK's statistics explain why the leak is regarded as especially sensitive.

For taxpayers who may be impacted by the breach, the best approach is to treat any unexpected phone call, email message, or text with skepticism, regardless of how much personal information the sender may have. Passwords, recovery phrases, and private keys should never be given out, and users should open the website or app of the relevant organization directly rather than using links or contact details from an unsolicited message.

The lesson is simple: personal data is part of the attack surface. In crypto, where trust can be the final barrier before an irreversible transaction, stolen information can become the tool that makes a scam believable — or helps a criminal decide whom to target.