France's Ministry of Economy and Finance has confirmed that attackers extracted data belonging to 678,000 individuals and professionals from the systems of the Direction Générale des Finances Publiques (DGFiP), the national tax authority — and the stolen database has been listed for sale on a criminal forum.
The incident matters to crypto holders for a reason that goes beyond identity fraud: tax records tie a name, an address, and an income figure into a single record. In France, that combination has already been weaponized against crypto investors once before.
The Breach, as Confirmed
According to a BleepingComputer report citing the Finance Ministry's official statement, the intrusion was detected after a threat actor using the handle "ZeroBytes" claimed the attack on August 12 and listed a stolen database for sale on the PwnForums hacking forum.
The ministry's investigation established that before the access points were shut down, the attackers had consulted and extracted data on 678,000 individuals and professionals, including:
- Reference tax income
- Family quotient
- Withholding tax rate
- For businesses: company name and SIREN registration number
- Cadastral data, including addresses and property sizes
The ministry stated that online account credentials and passwords were not compromised, that the French data protection authority CNIL was notified, and that France's national cybersecurity agency ANSSI is assisting the investigation. Notification of all affected individuals was scheduled to begin this week by email or letter.
ZeroBytes additionally claimed access to the SPDC, the platform serving France's central land registry and property ownership records, asserting the theft of roughly 252,000 records covering more than two million people out of a portal reachable for some 20 million citizens. Those claims remain unverified and are attributed to the attacker's own forum post.
The Crypto Angle: When Tax Data Becomes a Targeting List
The most serious precedent is not the forum listing but a French insider case. According to reporting by IMI Daily on court filings from the Bobigny prosecutor's office, a tax official allegedly used DGFiP's internal Mira software to run searches specifically targeting cryptocurrency specialists and investors, then sold the resulting personal data to criminal networks for extortion and physical attacks. In one documented episode in September 2024, three armed men attacked a target at his home in Montreuil using an address prosecutors say was obtained through the tax system. The official has been in custody since June 2025.
The lesson generalizes: a tax database is a pre-sorted wealth map. Combined with blockchain analytics, public transaction history, or exchange leak data, it lets criminal groups prioritize exactly the households most likely to hold significant crypto balances — and physical "wrench" attacks bypass every safeguard a hardware wallet provides. CertiK's H1 2026 intelligence reporting has tracked a rising share of crypto losses coming from exactly this class of offline coercion rather than on-chain exploits.
Context and Recommendations
The DGFiP breach is part of a broader wave of French government compromises: the unemployment agency France Travail was fined €5 million in January over a breach affecting 43 million people, the FICOBA bank account registry breach affected 1.2 million accounts, and France Titres disclosed a breach after a seller offered a database of 19 million records allegedly stolen from the secure documents agency ANTS.
For crypto investors in France — and holders anywhere whose tax filings connect holdings to a home address — the practical guidance is the same:
- Treat the possibility that your tax profile is exposed as an operating assumption, not a hypothetical.
- Separate disclosure-linked wealth from physical location where legally possible: custody solutions without a single home-address linkage, PO boxes for legal correspondence, and multi-signature setups that cannot be coerced on the spot.
- Expect targeted phishing that uses authentic tax data as bait. Real reference tax income in an email is a strong credibility signal; verify any message through official government portals directly.
The ministry has not attributed the ZeroBytes intrusion to any group, and no arrests have been announced. The database listing price circulating on forums has been reported in the thousands of euros — a small sum for data whose potential resale value to targeting operations is far higher.