France's tax agency cut off the intruder in June and warned taxpayers in August

An intruder broke into the systems of France’s Directorate General of Public Finances (DGFiP) and removed personal and tax records of individuals and companies, the agency said on August 13.

The government says the exposure could affect millions of people and provide criminals with a ready-made list of targets.

How the access was opened and then cut off

The intrusion, which started with a stolen identity, dates to late June 2026, the ministry said in a statement.

In an internal control that month, staff detected the illegitimate access and turned it off by the end of June.

On August 12, a malicious actor claimed online to have been inside the DGFiP information system. The ministry issued its press statement the next day.

By the time that public claim was made, the original route was already shut down. But the ministry said the intruder had still been able to view and extract data while the access was live.

The DGFiP added restrictions to prevent new entries following the attacker’s August 12 boast, the statement added. The attacker gained access to a taxpayer search tool via a compromised internal VPN.

The DGFiP has not yet issued a definitive list of what was taken. Investigators are still trying to nail down the data and the number of users involved.

A vast number of fields could have been exposed, including names, birth details, postal addresses, telephone numbers, e-mail addresses, tax identification numbers, withholding tax rates, and taxpayer correspondence with officials.

The theft could also have snatched business registration numbers. The exposed data did not include any user names or passwords.

France’s data protection regulator, CNIL, has been notified. The DGFiP said it would also file a criminal complaint and send affected users individual notices detailing which of their data may have been viewed or extracted, along with any precautions to take.

The agency is working with the ministry’s Haut fonctionnaire de défense et de sécurité (SHFDS) and the national cybersecurity agency, ANSSI.

🔴Accès illégitime au système d’information de la Direction générale des Finances publiques.

Pour en savoir plus : https://t.co/i4Bgn2e2km pic.twitter.com/G6OD4lh49S

— Ministère de l’Économie et des Finances (@Economie_Gouv) August 14, 2026

Why a tax leak lands hard on crypto holders

France has spent 2026 suffering a spate of violent attacks against digital asset holders. As reported by Cryptopolitan, in April, Telegram founder Pavel Durov said on X that France had seen 41 kidnappings of crypto holders in the first three and a half months of the year.

French police confirmed 40-plus kidnappings or attempted kidnappings since January, compared with around 30 last year. Prosecutors said they had charged 88 people in the cases.

Durov put the growth down to leaked personal data and said data held by tax authorities was part of the problem.

As previously reported by Cryptopolitan, French tax bodies have been building out records that link identities to crypto positions, with proposals to force reporting of holdings above 5,000 euros and plans to tax crypto wealth above 2 million euros at 1% a year, including coins in self-custody.

A file tying a taxpayer’s name to an address and a tax profile is exactly the kind of raw material that has preceded physical attacks on holders.

The DGFiP said it would release more as its inquiry progresses.

If you're reading this, you’re already ahead. Stay there with our newsletter.