French tax leak exposes crypto taxpayers’ data

A large set of French tax records posted online this week revealed personal taxpayer information, including names, postal addresses, phone numbers, some email addresses, declared incomes, tax debts and flags indicating whether individuals reported cryptocurrency gains or holdings.

The files appear to contain tax assessment data and parts of individual tax returns. Security researchers who examined samples described the visible fields and said the data circulated on public forums and private channels.

The leak comes ahead of French tax filing deadlines. Authorities are assessing the scope, notifying affected taxpayers and have not released full details about how the breach occurred or the total number of records exposed. Officials advised people to verify any tax-related messages through official channels.

Security and risk professionals warn the exposed details could help criminals target people who own bitcoin or other digital assets. With names and contact information, attackers can craft phishing emails or text messages that reference tax details to try to obtain wallet keys, exchange login credentials or two-factor authentication codes.

The information could also support SIM swap attacks by providing personal data that mobile carriers sometimes use to confirm identity. Attackers could use leaked identity data to open fraudulent accounts on cryptocurrency exchanges, complete know-your-customer checks with stolen documents, or move funds from compromised accounts.

The files may also enable extortion attempts. Attackers could claim to have proof of a taxpayer’s declared crypto holdings and demand payment in cryptocurrency to avoid public exposure or alleged legal action.

Identity theft and fraud are further risks when personal data is exposed. Fraudulent loan applications and other misuse of personal information can follow. Tax and crypto-related entries in the records could complicate victims’ efforts to trace transfers or reclaim assets when blockchain transactions are irreversible.

Consumer and digital-security groups advise anyone who believes their tax information was exposed to change passwords, enable hardware-based two-factor authentication where available, monitor exchange accounts and consider placing fraud alerts with banks and mobile providers. People should avoid responding to unsolicited messages that reference the leak and report suspicious contact to law enforcement.

France requires taxpayers to declare gains from sales of digital assets and to include certain crypto-related information on returns. That reporting means tax files can identify individuals who engaged in crypto transactions during a given tax year.

A cybersecurity specialist who reviewed samples warned, “A list that links a name and contact details to a declared interest in crypto gives attackers the social proof they need to succeed with tailored scams.”

Cybersecurity analysts note that similar breaches in other countries have led to increases in phishing and targeted attacks. French officials must secure taxpayer data, notify victims and pursue those responsible while affected individuals assess their security and financial risks.