Overview
- France’s tax administration, DGFiP, confirmed a breach that a hacker says left a partial dataset of roughly 678,438 records after access was cut off, and French cybersecurity researchers are still investigating the full scope.
- Samples reviewed by FrenchBreaches show the leak includes highly sensitive fields such as full legal names, birth details, home and email addresses, phone numbers, internal tax IDs, income figures and past correspondence with tax officials.
- The attacker using the alias “ZeroBytes” claims to have used stolen VPN credentials and an internal DGFiP lookup tool to extract data in late June, and the file is now being offered for sale for several thousand euros.
- The leaked records include tens of thousands of high-income taxpayers—about 26,805 with reference income ≥€100,000, 386 above €1 million and eight above €10 million—heightening the chance of convincing phishing, identity fraud and violent extortion known as wrench attacks.
- Investigations are ongoing and authorities have cut the intrusion path; the breach follows a recent Trezor customer-data incident and comes when industry trackers report an uptick in crypto-targeted kidnappings and home invasions in France, increasing both digital and physical safety concerns.