# French tax authority and FICOBA data breach

> Live situation record from CLSTR: https://clstr.news/situations/french-tax-authority-data-breach
> Updated: 2026-08-15T09:01:19.000Z. Sources: 53. Developments: 2.

In mid-August 2026, the French General Directorate of Public Finances (DGFiP) confirmed a major cyberattack that occurred between late June and early July. The breach, facilitated by the identity theft of an employee, resulted in the unauthorized extraction of sensitive data belonging to approximately 678,000 individuals and businesses.

Stolen information includes names, birthdates, addresses, phone numbers, email addresses, family status, and fiscal details such as taxable income and withholding tax rates. The breach notably affects high-income earners, including over 28,000 people earning more than €100,000 and approximately 400 earning over €1 million. Officials have described the incident as more sophisticated than previous attacks.

In a related development, the national bank-account register, FICOBA, was also compromised. Investigators report that an attacker used the credentials of a government official from outside the tax authority to access roughly 1.2 million accounts, allowing for the consultation of identifiers such as IBANs.

Security experts have raised alarms regarding the potential for identity theft and targeted scams. There is specific concern for cryptocurrency investors, as the leaked financial data could facilitate ‘wrench attacks’—violent physical crimes used to extort digital assets—by helping criminals link real-world identities to significant digital holdings.

The Paris prosecutor's office has launched a formal investigation into the fraudulent extraction and potential criminal association, tasking the Office anticybercriminalité (Ofac) with the case. The DGFiP has apologized and stated it is taking measures to secure its systems.

## Claims

- The French tax authority confirmed a data breach affecting 678,000 individuals and businesses. (corroborated by 9 sources)
- Leaked data includes names, family status, taxable income, and withholding tax rates. (corroborated by 8 sources)
- The Paris prosecutor's office has opened an investigation into the fraudulent extraction of personal data. (corroborated by 7 sources)
- The breach increases the risk of 'wrench attacks,' where criminals use physical violence to force cryptocurrency holders to surrender assets. (corroborated by 2 sources)
- Security analyst Jameson Lopp noted that over 28,000 victims earn more than 100,000 Euros, with 400 earning over 1 million Euros. (single source)
- France has been identified as a hotspot for physical crypto-related attacks, including 36 reported incidents. (single source)
- The attacker used credentials from a government official outside the tax authority to access the FICOBA register. (single source)
- Approximately 1.2 million accounts were consulted in the FICOBA register breach. (single source)

## Timeline

### 2026-08-15: French tax authority data breach affects 678,000 users

A major cyberattack on the French tax authority has exposed the personal and business data of 678,000 users, prompting a criminal investigation and raising fears of targeted crypto-related extortion.

14 sources. https://clstr.news/cluster/france-tax-data-breach-exposes-678000-users-to-crypto-extortion-risks

### 2026-08-13: France tax authority suffers cyberattack exposing 678,000 taxpayers

France's tax authority (DGFiP) confirmed a cyberattack in June 2026 that compromised the data of approximately 678,000 taxpayers, exposing sensitive personal and financial information.

44 sources. https://clstr.news/cluster/dgfip-tax-data-breach-678000-french-citizens-information-stolen

---
Cite as: French tax authority and FICOBA data breach. CLSTR, https://clstr.news/situations/french-tax-authority-data-breach