A tax breach just handed French crypto holders' addresses and incomes to whoever pays

France's tax authority has lost records covering 678,000 taxpayers, and a hacker is now marketing the file ^[1]. That matters beyond the usual breach-notification ritual because in the same half-year, blockchain security firm CertiK verified 52 physical coercion attacks on crypto holders worldwide and 33 of them happened in France ^[12].

The composition of the file is the problem. French cybersecurity outlet FrenchBreaches, which first reported the sale, says the data came from the DGFiP and covers 392,867 individuals and 285,570 professionals ^[4][5]. A sample carried names, addresses, phone numbers, income figures and family details ^[2][6]. FrenchBreaches counted 26,805 individuals with a reference income of at least $116,000, 386 above $1.16m, and eight above $11.6m ^[7]; Jameson Lopp, citing the same tiers in euros, put it at 26,805 people over EUR100,000, 386 over EUR1m and eight over EUR10m ^[8]. On the individual count, that top band is roughly 6.8% of the natural persons in the file ^[21] - a pre-sorted list of who is worth the trip.

The ministry's own account of the intrusion is not reassuring. France's Finance Ministry says the attackers used stolen VPN credentials to reach one of the agency's internal search tools towards the end of June ^[9]. Their access was cut during a routine check, but the data theft itself was not detected at the time ^[10]. Reuters reports 678,000 users affected, with personal notifications to follow, and the full scale still being established ^[11]. Something in the order of six weeks passed between that late-June access and Lopp flagging the file publicly on 14 August 2026 ^[22].

CertiK's own explanation for the French concentration is instructive: a sizable domestic crypto industry, well-known business leaders, publicly displayed wealth, and a run of sensitive data breaches ^[13]. The firm calls the resulting method data-driven targeting - combining leaked records with social media, on-chain activity and public information ^[14]. A tax file collapses the expensive part of that work. Names establish identity, addresses establish location, and income establishes whether the effort pays. The other 19 verified attacks in CertiK's H1 dataset were spread across the rest of the world ^[23].

The softer downside is fraud that now reads as authentic. Chainalysis estimates criminals took a minimum of $17bn from crypto scams and fraud in 2025, with impersonation scams growing by more than 1,400% over the year ^[15][16]. Cybermalveillance.gouv.fr has already reported fraudsters posing as crypto platform staff ^[17]. A caller who knows your declared income and household composition does not need to be persuasive.

Lopp raised the same concern in January 2026 over a separate case involving a French tax official accused of using privileged access to identify crypto owners ^[18]. The two incidents should not be presented as connected ^[19], but they point at the same exposure: the state holds the cleanest wealth register in the country.

Watch three things. Whether the 678,000 figure holds as the ministry completes its assessment ^[11]. Whether notification letters tell recipients anything actionable about which fields were taken, given that address and income together are the operative combination ^[2]. And CertiK's H2 2026 count, which is the only near-term measure of whether data-driven targeting converts this file into incidents.