A breach of France’s tax administration has exposed personal and income data linked to about 678,000 people, creating a potential targeting list for fraudsters and criminal groups as the country faces a rise in violent attacks connected to cryptocurrency holdings.
France’s Finance Ministry said an attacker entered systems operated by the General Directorate of Public Finances in late June and extracted records involving both individual and professional taxpayers. The ministry said the investigation remains under way and has not confirmed a final number of people affected.
FrenchBreaches, a platform that tracks cyberattacks, put the number of exposed people at 678,437, roughly 1% of France’s population. It said the stolen material was being offered on dark-web marketplaces for several thousand euros.
The records reportedly include names, dates of birth, residential addresses, phone numbers, email addresses, tax identifiers, income figures and other contact information. Such data can give criminals far more than a route for phishing emails: it can help them identify affluent households, locate them and tailor scams around real personal details.
Income data raises risks for affluent households
According to FrenchBreaches, the files contain income information for nearly 27,000 people who declared at least €100,000 in tax income. The database reportedly includes 386 people earning more than €1 million and eight reporting income above €10 million.
The attacker, using the alias ZeroBytes, claimed to have accessed an internal search tool and extracted the records before French authorities detected and ended the intrusion. Those claims have not been independently confirmed by the Finance Ministry, which has disclosed the breach but has released limited technical details during the investigation.
The files do not appear to identify cryptocurrency holders directly. Yet income data combined with names and home addresses can narrow the pool of potential targets for extortion, impersonation, burglary and kidnapping. Crypto holders may face a particular threat because criminals can force victims to transfer assets immediately, often without the recovery options available in traditional banking fraud cases.
Jameson Lopp, a Bitcoin security researcher who maintains a public database of physical attacks against crypto holders, drew attention to the French breach on X. Lopp’s database spans almost 12 years and documents incidents ranging from home invasions to kidnappings and assaults intended to obtain cryptocurrency access or private keys.
Violent crypto crime has become a French security concern
Chainalysis recorded 30 publicly known violent attacks tied to cryptocurrency in France during the first half of 2026, with reported losses exceeding $30 million. If losses continued at the same pace through the second half, they would surpass the $58 million recorded during 2025 under the same tracking methodology.
The figures underline how criminal interest has shifted beyond online theft. A compromised password or seed phrase can be valuable, but a person identified as wealthy and connected to crypto can also become a physical target.
Chainalysis has linked France’s recent pattern to a separate case involving a French tax employee accused of selling confidential information connected to crypto holders to criminal groups. Authorities arrested the employee in June 2025, according to Chainalysis.
Reports from the Somme department this week illustrated the risks created when financial profiles and address records circulate online. A couple was reportedly targeted three times in less than a month after moving into a property previously occupied by crypto millionaires. The former residents’ tax information and address had appeared on the dark web, according to the reports.
The case shows the danger of stale records as well as current ones. Even households with no crypto exposure may be approached if criminals believe an address remains linked to digital assets or a high-income former resident.
Separate breaches can create a more detailed target profile
The French tax breach follows other incidents that have exposed personal information connected to crypto users. Hardware-wallet maker Trezor disclosed a shipping-provider breach affecting nearly 14,000 customers. Trezor said compromised data included phone numbers and addresses for 11,742 people.
A tax leak and a customer-shipping leak do not automatically identify the same individuals, and neither dataset alone proves that a person owns crypto. Criminals do not need certainty to act, though. Matching names, addresses, contact details and income bands across multiple stolen datasets can make a household appear attractive enough for targeted fraud or surveillance.
Scammers can use accurate personal information to make messages and calls seem credible. A caller who knows a person’s name, address, recent purchase or income bracket may pose as a tax official, wallet provider, police officer or delivery company before attempting to obtain wallet recovery phrases or persuading a victim to move assets.
No legitimate wallet provider, tax authority or law-enforcement officer should request a seed phrase, private key or full wallet-access credentials by phone, email, text message or in person. Holders who receive unexpected contact containing accurate personal information should assume that the details may have originated from a breach rather than treating them as proof that the caller is genuine.
Privacy failures now carry offline consequences
The French incidents place renewed focus on the physical-security costs of collecting and retaining sensitive personal data. Tax agencies must hold extensive records, but the alleged use of internal search access shows how a single compromise can turn administrative information into a tool for identifying households by wealth and location.
Reporter Nakamoto has said foreign criminal groups increasingly recruit young local actors to carry out physical attacks, reducing the need for organizers to operate directly in the area where a target lives. That structure can make data leaks especially dangerous: stolen information can be packaged, sold and acted on by different groups at different stages.
For people managing cryptocurrency, the immediate response is likely to be practical rather than technical. They can treat unsolicited contact with unusual caution, avoid sharing asset holdings or wallet arrangements publicly, and ensure family members know never to disclose recovery phrases. The French breach adds a large pool of real-world identity and income data to an environment where criminals have already shown a willingness to pursue crypto access through physical coercion.
Worried about breaches like this? Strengthen your defenses with crypto account security tips from Toobit Academy.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
