France Lost 678,000 Taxpayers and Said Nothing for Six Weeks

The French Ministry of Finance confirmed this week that a malicious actor breached systems at the Direction Générale des Finances Publiques — the national tax administration — and stole data belonging to 678,000 individuals and businesses.

The intrusion was detected and cut off in late June 2026 during routine security checks. The ministry made no announcement at the time.

Disclosure came on August 12, after an actor operating as ZeroBytes claimed on a criminal forum to have gained access following an identity theft. Investigations continue in coordination with ANSSI, the national cybersecurity agency.

The fields are the story

Most breach disclosures list what was taken as though the categories were interchangeable. They are not, and this set is unusually bad.

For individual taxpayers, the compromised data includes full names, addresses, phone numbers, family quotient details, reference taxable income, and withholding tax rates.

Reference taxable income — revenu fiscal de référence — is the French tax system's canonical measure of a household's income. Family quotient encodes household composition. Together with a name and a physical address, they constitute a precise, verified, government-computed list of who is wealthy and where they live.

That is not a credential dump. Credentials get rotated. This is a permanent attribute set that cannot be changed, sourced from the one institution that is definitionally accurate about it.

Why this lands hardest on crypto holders

The immediate operational risk being flagged is physical: wrench attacks — coercion of an individual to hand over private keys under threat of violence.

The logic is direct. Wrench attacks require the attacker to identify a target with substantial holdings and locate them physically. Those are the two hard steps, and historically they have been solved through on-chain analysis, social media exposure, or conference proximity — all noisy, all inferential.

A tax dataset solves both steps at once, with state-verified accuracy. High reference taxable income plus a home address is exactly the query an attacker would want to run, and France has had a documented run of such incidents over the past two years.

The exposure is not limited to crypto. The same list serves kidnapping-for-ransom, high-value burglary, and targeted fraud against anyone the state has recorded as wealthy. Crypto holders are simply the population for whom the theft is most immediately convertible — a private key transfers irreversibly in seconds, which no other asset does.

The six weeks

The gap between detection in late June and disclosure on August 12 is the part that will define the political aftermath.

GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach, and communication to affected individuals without undue delay where there is high risk to their rights and freedoms. A breach exposing income and home address to a criminal forum is squarely in high-risk territory.

There are legitimate reasons an agency delays public notification: an active investigation, uncertainty about scope, the risk of alerting an attacker still inside the network. Those reasons are real and they are not always disclosed at the time.

What weakens the case here is the sequence. The ministry did not disclose after completing its assessment. It disclosed after the attacker went public. Whatever the internal reasoning, the affected population learned they were exposed from a criminal forum's audience rather than from their government — and for six weeks, the people most at physical risk had no reason to change anything about their security posture.

That is the gap that matters. Not the legal exposure to a regulator. The six weeks during which 678,000 people were on a list they didn't know existed.

Tax agencies are becoming a category

This is not an isolated event. Tax authorities have emerged as a distinct target class, and the reasons are structural.

They hold complete, verified financial profiles of an entire population — coverage no commercial dataset can match. They are legally obligated to be accessible to the public, which means large internet-facing surfaces with authentication for tens of millions of citizens. They run substantial legacy infrastructure, because tax systems accumulate decades of code that cannot be rewritten without risking a filing season. And their integrations with employers, banks, and other agencies multiply the paths in.

The claim that access followed an identity theft points at the citizen-facing authentication layer rather than at a network perimeter. If accurate, it means the attacker used the system the way it was designed to be used, as someone they were not — which is a much harder problem to fix than a patch, because the vulnerability is the requirement that ordinary people be able to log in.

The read

Three things are worth separating.

The data cannot be remediated. There is no rotation, no reissue, no reset. Income and address are attributes, not secrets, and 678,000 people now have theirs in circulation permanently. Notification is not a fix; it is a warning that the fix does not exist.

The disclosure timeline is the institutional failure, distinct from the breach itself. Any sufficiently large system will eventually be breached, and the state's competence is properly measured by detection, containment, and notification. France did the first two in late June. It did the third in August, under pressure, after the attacker had already spoken.

And the target class is now established. A tax authority holds the single highest-value dataset any government maintains about its citizens — better than a credit bureau, better than a bank, better than any social platform, because it is compulsory and verified. Every finance ministry running citizen-facing authentication over decades-old infrastructure should read this as the specific scenario it is being tested against.

France's answer arrived six weeks late, from a criminal forum.