DGFiP cut off the access in late June during routine checks but only reconstructed the full scope after ZeroBytes posted on August 12. The agency has notified the CNIL, filed a complaint, and said each affected taxpayer will be individually informed, though no timetable has been given. A second alleged breach targeting the cadastral server, claimed by the same actor for late July and said to involve over two million property holders, remains unconfirmed by authorities.
The breach arrives as France contends with a sharp rise in violent crimes targeting cryptocurrency holders, known as "wrench attacks." Chainalysis documented 46 such incidents globally through late June 2026, 30 of them in France, with losses exceeding $30 million. French Interior Minister Laurent Nuñez reported a higher count of 77 crypto-related kidnappings, unlawful detentions, and extortion attempts in the first half of 2026, up from 45 in all of 2025. The attack rate accelerated from 1.9 incidents per month in 2025 to 4.6 in the first half of 2026.
Chainalysis and French officials have linked the surge to prior data compromises, including the 2025 arrest of a tax official accused of selling dossiers containing crypto holdings and personal details, and a January 2026 leak at crypto tax firm Waltio that exposed roughly 50,000 user records. The newly confirmed DGFiP breach adds a larger, authoritative dataset that pairs verified identities with income and address information, precisely the profile attackers use to select targets.