Tax Data of 678,000 People Leaked in France: Could Become a Target List for Crypto Extortion Attacks

As income and contact information of 678,437 individuals were leaked in a cyberattack targeting the French tax office, it is reported that the dataset could become a new target list for the country’s rising physical crypto extortion attacks.

The French Finance Minister confirmed that a hacker who breached the Directorate General of Public Finances at the end of June extracted records belonging to individual and corporate taxpayers. It is stated that the data spread following the attack could facilitate the work of criminals targeting wealthy individuals.

FrenchBreaches announced the number of affected individuals as 678,437; it was noted that the final figure may change as the investigation continues. The records reportedly contain names, dates of birth, home addresses, phone numbers, email addresses, income information, and tax identification numbers. Among those affected are approximately 27,000 individuals with an income of at least 100,000 euros, 386 people reporting earnings over 1 million euros, and eight people exceeding 10 million euros. It is alleged that the database has been offered for sale on the dark web.

Crypto extortion attacks are breaking records in France

The leak does not directly indicate which individuals own cryptocurrency. However, the list, which combines high income and address information in the same record, could help identify wealthy targets for crimes such as fraud, home invasions, or kidnappings. Crypto security researcher Jameson Lopp stated that the development is bad news regarding “wrench attacks”—attacks aimed at forcibly seizing access to crypto—in France.

Chainalysis reported that over $30 million was lost in 30 violent crypto attacks in France during the first half of 2026. This pace suggests that the $58 million record stolen in the country in 2025 could be surpassed. Additionally, Trezor announced that a breach at the shipping company ShipMonk affected the information of approximately 14,000 customers. While it was stated that the phone and address information of 11,742 people was leaked in this incident, a direct link between the breach and crypto extortion attacks has not been confirmed.