France's tax administration, DGFiP, has confirmed a data breach that exposed sensitive financial and personal information belonging to hundreds of thousands of taxpayers and businesses. The hacker, going by the alias ZeroBytes, claims to have pulled a partial dataset of 678,438 records before the extraction was interrupted. The leak includes income details, tax IDs, and correspondence with tax officials — a goldmine for phishing and identity theft, and a particular worry for the crypto community.
What the stolen data contains
The leaked records cover roughly 392,867 individuals and 285,570 businesses. For individuals, the data includes full legal names, dates and places of birth, addresses, marital status, number of dependents, tax identification numbers, reference taxable income, withholding tax rates, phone numbers, email addresses, and correspondence with tax officials. Businesses weren't spared either, though the facts don't specify what's in their files.
The income data is striking. Among the individuals, 26,805 have annual taxable income of €100,000 or more. Another 386 exceed €1 million, and 8 exceed €10 million. That kind of detail, security analysts warn, could fuel phishing campaigns impersonating tax authorities, identity theft, and fraud tailored to a victim's income or family circumstances.
Wrench attack warning
Bitcoin developer Jameson Lopp has been sounding the alarm about the physical threat to crypto holders, and he sees France as a hotspot. Lopp's tracker counts over 70 wrench attacks globally in 2025, with TRM Labs reporting around 55. This year, 54 attacks have been documented so far. France leads in wrench attacks, according to Lopp.
The 2025 kidnapping of Ledger co-founder David Balland and his wife — they were held for about 24 hours before rescue — remains a stark example. The DGFiP leak, with its detailed income and personal data, could give criminals a ready-made list of high-value targets. Lopp warned Bitcoiners directly, noting that France is a leader in these attacks.
A bad week for hardware wallets
The DGFiP breach came just one day after Trezor, a major hardware wallet maker, announced a separate data breach exposing customer data. Two security incidents in two days, both involving sensitive personal information, is a rough stretch for anyone worried about crypto security. Trezor's breach and the French tax leak are unrelated, but together they underscore how much personal data is floating around — and how easily it can end up in the wrong hands.
The VPN credential question
ZeroBytes claims to have obtained VPN credentials for DGFiP servers. If true, that's potentially a bigger problem than the partial dataset itself. The hacker said the extraction was interrupted, leaving the dataset incomplete, but the credential access could allow further intrusions. DGFiP has not commented on the extent of the VPN compromise, and it's unclear whether the credentials have been revoked.
The breach is still under investigation, and the full fallout won't be known for a while. But the combination of detailed financial data and a possible ongoing access point makes this a situation worth watching.
