France’s General Directorate of Public Finances has confirmed a data breach that affected 678,438 taxpayers after threat actors accessed and extracted files from internal systems. The agency said it shut down the attacker’s access on June 12 and later determined that the intrusion had led to data theft.

The exposed information reportedly includes addresses and real estate-related data, while the tax authority said credentials used to access its site were not compromised. The incident has drawn particular attention from French cryptocurrency holders, who say the leak could increase the risk of targeted physical extortion attacks.

Attack acknowledged after internal compromise

According to the reported details, a pseudonymous hacker known as Zerobytes claimed responsibility for the breach and said the intrusion was carried out through an internal search VPN tool used to reach DGFiP servers. Local reports cited by the source said the attacker may also have been linked to earlier attacks on French institutions.

DGFiP said it moved immediately to disable all accounts involved in the identified incidents on June 12. However, the agency stated that the access reviews carried out at that time did not initially detect that data had been copied, attributing that failure to what it described as the sophistication of the attack.

What data was taken and what was not

The stolen file is said to contain records tied to 678,438 contributors. The source article said the extracted material included personal addresses and information related to real estate holdings.

At the same time, DGFiP said the breach did not expose login data used to access its online services. The agency also said it has put in place additional security measures intended to prevent a similar incident from happening again.

Data reportedly offered for sale

Even though the attacker’s access was eventually cut off and the source article said not all taxpayer data was recovered, the information obtained is reportedly being offered for sale for a few thousand euros.

That has added urgency to concerns around secondary misuse of the records, especially because the dataset appears to combine identity and property-related details that could be valuable to criminals.

Crypto holders warn of physical security risks

Reaction on French social media has been especially strong among cryptocurrency holders, who fear the leak could make some individuals easier to identify and target. The concern centers on so-called wrench attacks, in which criminals use threats or violence to force victims to hand over digital assets or access credentials.

The source article placed those concerns in the context of a broader rise in crypto-linked kidnappings and extortion cases in France. By April, France had charged 88 people across 12 crypto-related kidnapping cases, with 41 attacks registered at that time. It also noted earlier allegations that a tax official had sold data linked to high-profile crypto holders.

Next step is direct notification

DGFiP said it will contact each affected individual and professional directly next week by email or post. Those notices are expected to specify what data may have been viewed or extracted and, where relevant, the precautionary measures recipients should adopt.

For now, the confirmed timeline is limited: the agency says access was cut off on June 12, the breach affected 678,438 taxpayers, and credentials were not compromised. Further detail is expected to come from the individual notifications and any additional updates from French authorities.

Source: news.bitcoin.com