Who holds the data?
DAC8 requires crypto providers to collect it. A summer breach at the French tax administration illustrates the risks of holding it.
One regime, several holders
DAC8 moves personal data along a chain. Since 1 January 2026, crypto-asset service providers in the EU have been collecting identification and tax residency information from their users and recording their transactions. From 2027 they report it to their national tax authority, in Luxembourg and Poland by 30 June 2027, and the authority then exchanges it with the authorities of the users' countries of residence. The first automatic exchanges between Member States are due by 30 September 2027.
The data starts with the client, sits first with the provider, then with the national authority, then with the authorities of other Member States. Each step creates a new holder, and each holder faces the same question: how well is the data kept?
The legal weight is not spread evenly. Providers face detailed obligations that are checked and sanctioned. In Luxembourg, for example, late reporting or missing registration carries a flat fine of EUR 5,000, and other breaches can reach EUR 250,000. A provider also answers for data protection and security in its own right. However the regime does not tell clients how the receiving end protects what arrives.
What happened at the DGFiP
On 14 August 2026, the French Ministry of the Economy and Finance confirmed that the information system of the tax administration (DGFiP) had been accessed illegitimately. Data on 678,000 individuals and businesses had been consulted or extracted: reference tax income, family quotient, the withholding tax rate, company names and SIREN numbers, and cadastral data on property addresses and surfaces. The ministry said that the personal online spaces were not breached and that identifiers and passwords were not compromised.
The incident report of the national cybersecurity agency (ANSSI), handed to the Prime Minister on 24 September and published on 29 September, gives the technical account. It covers illegitimate activity between May and August 2026 and two data sets: one taken from the impots.gouv.fr platform and claimed on 12 August, the other holding cadastral data and claimed on 13 August.
It finds weaknesses in three areas. In identity management, attackers stole and reused legitimate DGFiP credentials, taken after they had been used on personal devices, and strong authentication was missing on portals giving access to sensitive resources. In architecture, sensitive applications were exposed to the internet or reachable from the interministerial network without segmentation, and the attackers moved laterally from compromised resources belonging to a third party (the Ministry of Education). In detection, one portal used by the attacker was not monitored, no mechanism correlated the suspicious signals, and neither wave was detected by the monitoring of the DGFiP or of ANSSI. An action plan has been agreed with the DGFiP.
This was not DAC8 data, since the first DAC8 reports are not due until 2027. The point is what it shows about a tax authority as a holder. An authority is exposed to the same credential theft as any firm, and taxpayers cannot choose another one.
On 18 August, the CNIL said that it had been notified and was already seized of the matter, that individuals did not need to file a complaint, and that it could carry out investigations on documents or on site and impose sanctions. Press reports say that on 10 September its president, Marie-Laure Denis, announced on France 2 that the CNIL would inspect the DGFiP, and that the outcome could be a formal notice by the end of the year or a move towards a sanction. On 12 October, press reports say that the association of French crypto professionals, ADAN, had asked the CNIL to examine how the tax administration handled several incidents, after a letter to the ministry in March that went unanswered.
Not the first time, and not only France
The August breach was not the only incident at the French tax administration this year. The national bank account file (FICOBA) was accessed between late January and 13 February 2026 with the credentials of an official of another administration, according to the ministry's reply of 28 April to a parliamentary question. The reply says that the breach came from the use of that official's account and not from the exploitation of a flaw in the application, and that external access to FICOBA was cut. The question put the number of accounts at about 1.2 million and described the data as bank details, the holder's identity and address and, in some cases, the tax identifier. The reply confirmed neither, saying only that part of the file was consulted.
Other tax authorities have been in the same position. In 2019, the personal data of millions of taxpayers was taken from Bulgaria's National Revenue Agency: the press at the time reported about 4.1 million taxpayers, and the regulator's decision, as reported by the law firm CMS, concerns 6,074,140 individuals. The Commission for Personal Data Protection fined the agency 5.1 million leva (about EUR 2.55 million) for failing to put appropriate technical and organisational measures in place. The agency challenged the fine before the Sofia City Administrative Court, and according to the same source the case was dismissed because the absolute limitation period had expired. In the United States, an IRS contractor stole tax return information and disclosed it to two news organisations in 2019 and 2020. He pleaded guilty in October 2023 and was sentenced on 29 January 2024 to five years in prison.
These cases are not a league table. They differ in kind, an external attack in France and Bulgaria and an insider disclosure in the United States, and in time. What stands out in France is that two incidents in one year, at the same administration, both involved stolen credentials, and that they come as DAC8 gives the same authority a new category of sensitive data. The Bulgarian case also shows the limits of enforcement against a public body. A regulator fined the agency, but the case ended on limitation grounds, and in a 2023 judgment in a related damages case (C-340/21) the Court of Justice held that unauthorised access by a third party does not by itself show that the controller's security measures were inappropriate.
The physical risk
For holders of crypto-assets, a leak is not only a privacy problem, because a person who can be identified and located can be targeted. France is also where physical attacks on holders are most reported. On 9 October 2026, the Organized Crime and Corruption Reporting Project (OCCRP) reported, citing the French national prosecutor's office for organised crime (PNACO), that French authorities had recorded 77 violent incidents targeting crypto holders so far in 2026, up from 67 in 2025 and about 20 in 2024. The blockchain security firm CertiK, using its own count of verified cases, recorded 24 physical "wrench attacks" in France between January and April 2026, about 71% of the 34 it found worldwide and 86% of those in Europe, against 4 in France in the same months of 2025. The two series use different methods and periods and cannot be compared directly, and CertiK itself says that its data shows only the visible part of an under-reported problem.
OCCRP reports that prosecutors point to data leaks, public social media disclosures and targeted phishing as the main ways criminals identify victims, and that the networks recruit young operatives online. Neither source ties the attacks to the August DGFiP breach or to tax data. The reported concern of ADAN is narrower: its complaint to the CNIL refers to suspicions that a tax agent disclosed information on crypto actors. That is why the question of who holds the data, and who can see it, belongs in the DAC8 discussion. Reporting data is exactly the kind of file that links an identity, an address and a crypto-asset activity.
What the Conseil d'État decided, and what it did not
On 14 September 2026, the urgent-applications judge of the Conseil d'État rejected a request by Paymium, Leonod and Satoshi Portal Inc. to suspend Decree n° 2025-1276, the French decree implementing DAC8 for crypto-asset service providers. The providers argued, among other things, that the decree forces them to collect and keep personal data, that a centralised register raises the risk of a leak, and that the CNIL was not consulted.
The judge ruled on one point only, which was urgency. Weighing the interference with privacy against the public interest in preventing tax fraud and evasion, the judge found that urgency was not established, and added that an alleged conflict with EU law cannot by itself establish urgency. The order also holds that the providers had not shown that a centralised register would increase the risk of compromise, and describes the risk as a mere possibility "dont la probabilité de réalisation est très faible" (whose probability of materialising is very low). It does not rule on the legality of the decree. The missing CNIL consultation, the arguments under Articles 7, 8 and 52(1) of the Charter of Fundamental Rights and the request for a reference to the Court of Justice belong to the merits, which are still pending. The French obligations stay in force in the meantime.
The order came a month after the ministry's release. It should be read as an urgency ruling, not as an assessment of how safely the state keeps tax data.
A question the Court of Justice has already touched
In October 2020, in joined cases C-245/19 and C-246/19, which came from Luxembourg and concerned information requested by another Member State under the earlier rules on exchange on request, the Court of Justice (Grand Chamber) held that the person ordered to supply information must be able to challenge the order directly in court. A taxpayer concerned by the investigation can be limited to challenging the order indirectly, in an appeal against the later tax adjustment, as long as that review is effective, and third parties can be limited to an action for damages. The Court treated the fight against international tax fraud and evasion as an objective of general interest that can justify limits on these rights. That case did not concern DAC8, but the French merits proceedings are where a comparable question could reach the Court, if a reference is made.
What to do now
For clients
Check what you gave your provider. The tax residency self-certification and the tax identification number now travel through the chain, and an error at the first step is copied at every later one. In Poland, providers must ask existing clients for the self-certification by 31 October 2026, and due diligence on existing users across the EU must be complete by 1 January 2027.
Ask your provider in writing how it stores, protects and shares the identification data it collects for reporting, and for how long it keeps it.
Keep your own record of transactions and reconcile it with what the provider holds.
For providers
Treat the reporting data as a high-value store. The ANSSI findings are a checklist: strong authentication on every access to sensitive data, segmentation so that a compromised third party cannot reach it, monitoring of every portal, and correlation of alerts. Apply the same controls to third parties with access as to staff, and plan the incident response before the first reporting cycle.
Document your data protection analysis of the reporting. The French providers' argument on the missing CNIL consultation shows where challenges to the regime are coming from.
The open question
The French breach does not show that DAC8 reporting is unjustified, and the Conseil d’État treated the public interest in preventing tax fraud and evasion as weighty. What it does show is that the regime leaves one question open: what the state owes in return for holding the data. We will follow the merits proceedings and the CNIL’s inspection.
