France's tax administration has confirmed a breach after attackers used stolen VPN credentials in late June to access a DGFiP taxpayer search tool and extract records now being marketed online, with FrenchBreaches putting the leak at 392,867 individuals and 285,570 professionals and Reuters reporting about 678,000 affected users. Sample files contained names, addresses, phone numbers, income figures and family details, with FrenchBreaches identifying 26,805 people above 100,000 euros in reference income, 386 above 1 million euros and eight above 10 million euros. Security researchers say the data could support highly tailored phishing, identity theft and impersonation scams, a growing risk in crypto markets where Chainalysis estimated at least $17 billion was stolen through scams and fraud in 2025 and impersonation scams expanded by more than 1,400%. The breach does not identify cryptocurrency holders, but it has heightened concern in France, where CertiK recorded 33 of 52 verified global wrench attacks in the first half of 2026 and researchers warn leaked tax data can help criminals decide whom to target.