Hacker Offers French Tax Records for Sale, Exposing Hundreds of Thousands to Risk
A hacker is reportedly selling a vast trove of French tax records, potentially exposing over 678,000 individuals and businesses to phishing scams, identity theft, and targeted attacks. The compromised data allegedly originates from France’s tax authority, the DGFiP, and was stolen during a breach in June.
According to a report by French cybersecurity outlet FrenchBreaches, the hacker is seeking several thousand euros for the database. Jameson Loop, Chief Security Officer at Bitcoin security platform Casa, highlighted the severity of the breach on X, noting, “The French tax authority has been hacked, and 678K records leaked.”
FrenchBreaches detailed that the compromised database contains records for 392,867 individuals and 285,570 professionals. Among these are 26,805 individuals with reported tax incomes of at least $116,000, 386 individuals earning over $1.16 million, and eight individuals with incomes exceeding $11.6 million. The hacker is said to be offering the complete file for several thousand dollars.
A sample of the leaked data, as described by FrenchBreaches, includes names, birth dates, home and email addresses, phone numbers, income figures, withholding tax rates, family status, dependent information, and tax-sharing details.
In an update, FrenchBreaches stated, “The DGFiP officially confirms the intrusion in its information system.” The firm added that stolen credentials were used in late June to access and extract taxpayer data, and the full extent of affected individuals is still under investigation.
The attacker reportedly exploited stolen VPN credentials and an internal search tool to extract names, contact details, tax identification numbers, income figures, withholding rates, and family information before authorities could revoke access.
FrenchBreaches warned that the availability of such sensitive tax information could enable scammers to craft highly credible fraudulent messages, far more convincing than generic phishing emails.
This data leak occurs amidst a concerning rise in “wrench attacks,” a form of crime where perpetrators use violence or threats to extort cryptocurrency. In July, cybersecurity firm CertiK reported 52 such attacks globally in the first half of 2026, with 33 occurring in France. Earlier this month, Chainalysis reported 46 attacks through June, including 30 in France, resulting in over $30 million in stolen funds.
Chainalysis noted that “criminals have recognized that crypto holders are high-value targets because they possess wealth in an instantly and irreversibly transferable form.”
Leave a Reply