A cyberattack on France’s General Directorate of Public Finances (DGFiP) has exposed personal and financial data linked to roughly 678,000 taxpayers, creating elevated security risks for high-income cryptocurrency owners. FrenchBreaches, the cybersecurity outlet that first reported the sale, estimates that 678,437 people were affected, including nearly 27,000 individuals who reported income above €100,000 and 386 who reported more than €1 million. The leaked file reportedly covers 392,867 individuals and 285,570 professionals, with records containing names, birthdates, addresses, phone numbers, email addresses, income figures and family information.
France’s Finance Ministry confirmed the breach and said the attackers used stolen VPN credentials to access an internal DGFiP search tool toward the end of June. The unauthorized access was cut only during a routine system check, and the full extent of the incident is still being assessed. Authorities plan to notify affected users, but a database matching the leaked information has already appeared for sale online, according to FrenchBreaches.
Security experts warn the leak is particularly dangerous for wealthy Bitcoin holders because it can enable highly convincing phishing, impersonation scams and physical attacks. Chainalysis estimates that criminals earned at least $17 billion from crypto scams and fraud in 2025, while impersonation scams grew by more than 1,400% over the same year. Jameson Lopp, a Bitcoin security advocate, called France the leading country for wrench attacks and noted on social media that the dataset exposes thousands of high-earning taxpayers. CertiK data supports that concern: the blockchain security firm recorded 52 verified wrench attacks globally in the first half of 2026, 33 of which took place in France, representing 63.5% of its dataset.
CertiK says the leak can facilitate data-driven targeting, allowing criminals to combine stolen tax information with social media, blockchain activity and public records to identify and locate potential victims. France’s cybercrime agency has reported fraudsters posing as crypto platforms, bank fraud teams and law enforcement officials to steal funds or sensitive data. Industry group ADAN estimates that about 11% of people in France own cryptocurrencies, expanding the pool of possible targets. Experts recommend that affected users remain skeptical of unsolicited calls, emails and messages, avoid sharing passwords, recovery phrases or private keys, and verify any financial request through official channels.
