France's tax office lost a wealth register and told taxpayers six weeks later

France's Directorate General of Public Finances said on August 13 that an intruder had used a stolen identity to view and extract personal and tax records belonging to individuals and companies ^[1]. The access began in late June 2026, staff caught it in an internal control and cut it off by the end of that month ^[2], which means the agency sat on the incident for roughly six weeks ^[2] and published only after a malicious actor claimed online on August 12 to have been inside the system ^[3] - a one-day gap between the boast and the press release ^[1].

The route was a compromised internal VPN into a taxpayer search tool ^[4]. No user names or passwords were taken ^[5], which is the least interesting part of the file. What may have been exposed is names, birth details, postal addresses, phone numbers, email addresses, tax identification numbers, withholding tax rates and taxpayer correspondence with officials, plus business registration numbers ^[6]. DGFiP has not produced a definitive list of what left, or a count of affected users ^[7]. The ministry says the exposure could affect millions ^[8].

The number in circulation is smaller and more specific. According to French outlet FrenchBreaches, cited by Decrypt, a hacker is selling records allegedly taken in the June breach covering 678,437 people and businesses ^[9]: 392,867 individuals and 285,570 professionals ^[10], figures that sum exactly to the headline total ^[3]. Of the individuals, 26,805 have reference tax income of at least $116,000, 386 above $1.16 million and eight above $11.6 million ^[11] - the top bracket is under 7 percent of the personal records ^[4]. FrenchBreaches says the sample includes income figures, withholding rates, family status, dependents and tax-share information ^[12], and that the file is on offer for several thousand euros ^[13], on the order of a cent per record ^[7].

That is the consequence. A validated income figure attached to a home address and a household composition is not a phishing list, it is a target list, sorted. FrenchBreaches noted that an attacker who knows a taxpayer's real figures and prior contact with DGFiP can write something far more credible than a generic fake email ^[14].

France has already seen what that raw material does. Pavel Durov said in April that France had recorded 41 kidnappings of crypto holders in the first three and a half months of the year ^[15], and blamed leaked personal data, including data held by tax authorities ^[16]. French police confirmed more than 40 kidnappings or attempted kidnappings since January against around 30 in the prior year, with 88 people charged ^[17]. CertiK counted 52 wrench attacks worldwide in the first half of 2026, 33 of them in France ^[18], about 63 percent ^[5]; Chainalysis counted 46 through June, 30 in France, with more than $30 million stolen ^[19], roughly 65 percent ^[6]. Casa's chief security officer called France "the leading country for wrench attacks" ^[20]. Chainalysis says criminals target crypto holders because their wealth is instantly and irreversibly transferable ^[21].

Meanwhile French tax bodies have been building records linking identities to crypto positions, with proposals to require reporting of holdings above 5,000 euros and to tax crypto wealth above 2 million euros at 1 percent a year, including self-custodied coins ^[22].

Watch three things: whether DGFiP's eventual count lands nearer 678,437 or the ministry's "millions" ^[9][8]; whether individual notices reach taxpayers before the file is resold, given DGFiP has promised notices detailing what was viewed ^[23]; and what CNIL, which has been notified, and ANSSI say about the VPN control that failed ^[24][25].