French Tax Breach Exposes Data of 678,000 Taxpayers

The French Ministry of Finance has confirmed a significant cyberattack targeting the General Directorate of Public Finances (DGFiP), resulting in the theft of personal data from hundreds of thousands of citizens. The breach exposed a massive database of taxpayer information, sparking an immediate investigation by the Paris prosecutor's office.

Approximately 678,437 taxpayers were affected by the breach. The exfiltrated information includes sensitive personal identifiers such as full names, dates of birth, residential addresses, phone numbers, and email addresses. Of particular concern is the exposure of high-earning individuals; the stolen records include nearly 27,000 people with annual incomes exceeding €100,000 and 386 individuals earning more than €1 million.

A Pattern of State Targeting

This incident is part of a broader trend of cyber aggression against French government infrastructure. Recent months have seen a surge in attacks targeting essential public services, including URSSAF and France Travail. This systemic vulnerability comes as France grapples with a rise in violent crimes targeting the wealthy, particularly those associated with digital assets.

The Risk of 'Wrench Attacks'

The exposure of a verified list of millionaires and high-earners creates a high-value "hit list" for criminal organizations. Security experts warn that this data increases the risk of sophisticated phishing campaigns and extortion attempts. More alarmingly, the breach coincides with a rise in "wrench attacks"—violent robberies where victims are coerced into transferring cryptocurrency under physical threat.

Data from Chainalysis highlights the severity of this trend, recording 30 publicly known violent cryptocurrency incidents in France through the first half of 2026. These attacks have contributed to global losses exceeding $30 million, suggesting that the combination of leaked tax data and a propensity for physical coercion creates a dangerous environment for wealthy residents.

Next Steps for Investigation

As the Paris prosecutor's office continues its probe, the primary focus remains on the origin of the breach and the current location of the stolen database, which has reportedly been offered for sale online. While the Ministry of Finance has acknowledged the system compromise, it remains to be seen whether the attackers gained access to deeper financial records beyond the basic personal identifiers currently confirmed. Authorities are expected to monitor dark web marketplaces for the distribution of the taxpayer list to mitigate further targeted crimes.