French Crypto Holders Targeted in Sophisticated Phone Scams Fueled by Tax Data Breach
A surge in phone scams is hitting France, with cybercriminals exploiting stolen tax records to impersonate support staff from major cryptocurrency platforms like Binance and Meria. The attackers pressure victims into transferring funds to fraudulent wallets, leveraging leaked personal data to identify crypto holders and their preferred exchanges.
Owen Simonin, founder of Meria (known online as Hasheur), linked the rise in fraudulent calls to a series of data breaches affecting both private companies and public agencies. In a September 20 post on X, he warned that criminals are cross-referencing leaked information to pinpoint targets, noting that legitimate platforms never initiate unsolicited calls requesting transactions or personal details. Simonin also highlighted the growing risk of AI-powered scam calls, which could escalate the threat in the coming months.
The most critical breach enabling these attacks occurred in mid-August, when France’s tax authority (DGFiP) revealed that an intruder had accessed private and tax records using a stolen identity. The intrusion, which began in late June and was contained by the end of that month, exposed sensitive data, including names, birth dates, addresses, phone numbers, email addresses, and tax IDs. While initial estimates suggested 678,000 taxpayers were affected, reports indicate the breach may have impacted millions.
The incident underscores the dangers of cross-referenced data leaks, as criminals combine stolen records to craft highly targeted social engineering attacks. With crypto holders now in the crosshairs, the breach’s fallout continues to unfold.
Source: https://finance.biggo.com/news/2995fb84-8d8f-41c6-9b5e-8c9f39e6c23f
Binance TPRM report: https://www.rankiteo.com/company/binance
Meria TPRM report: https://www.rankiteo.com/company/meria-finance
DGFiP TPRM report: https://www.rankiteo.com/company/direction-g-n-rale-des-finances-publiques
"id": "bindirmer1790037002",
"linkid": "binance, direction-g-n-rale-des-finances-publiques, meria-finance",
"type": "Cyber Attack",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '678,000+ (potentially millions)',
'industry': 'Public Sector',
'location': 'France',
'name': 'DGFiP (French Tax Authority)',
'size': 'Large',
'type': 'Government Agency'},
{'industry': 'FinTech',
'location': 'Global (France affected)',
'name': 'Binance',
'size': 'Large',
'type': 'Cryptocurrency Exchange'},
{'industry': 'FinTech',
'location': 'France',
'name': 'Meria',
'size': 'Medium',
'type': 'Cryptocurrency Platform'}],
'attack_vector': 'Stolen Tax Records, Impersonation, AI-Powered Scam Calls',
'customer_advisories': 'Meria and Binance advised customers to ignore '
'unsolicited calls and verify communications through '
'official channels.',
'data_breach': {'number_of_records_exposed': '678,000+ (potentially millions)',
'personally_identifiable_information': ['Names',
'Birth dates',
'Addresses',
'Phone numbers',
'Email addresses',
'Tax IDs'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personal Identifiable '
'Information (PII)',
'Tax Records']},
'date_detected': '2024-06-30',
'date_publicly_disclosed': '2024-08-15',
'description': 'A surge in phone scams is hitting France, with cybercriminals '
'exploiting stolen tax records to impersonate support staff '
'from major cryptocurrency platforms like Binance and Meria. '
'The attackers pressure victims into transferring funds to '
'fraudulent wallets, leveraging leaked personal data to '
'identify crypto holders and their preferred exchanges.',
'impact': {'brand_reputation_impact': 'High (for Binance, Meria, and DGFiP)',
'data_compromised': 'Names, birth dates, addresses, phone numbers, '
'email addresses, tax IDs',
'financial_loss': 'Funds transferred to fraudulent wallets',
'identity_theft_risk': 'High'},
'initial_access_broker': {'entry_point': 'Stolen identity used to access '
'DGFiP systems',
'high_value_targets': 'Crypto holders identified '
'via leaked tax data',
'reconnaissance_period': 'Late June 2024'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Cross-referenced data leaks enable highly targeted social '
'engineering attacks. Crypto holders are at elevated risk '
'due to the value of their assets. AI-powered scam calls '
'may escalate the threat.',
'motivation': 'Financial Gain',
'post_incident_analysis': {'root_causes': 'Stolen identity used to infiltrate '
'DGFiP systems, leading to '
'unauthorized access to tax '
'records. Lack of robust '
'authentication or monitoring may '
'have enabled the breach.'},
'recommendations': 'Avoid unsolicited calls requesting transactions or '
'personal details. Verify the legitimacy of communications '
'through official channels. Enhance monitoring for '
'AI-powered scam attempts.',
'references': [{'date_accessed': '2024-09-20',
'source': 'Owen Simonin (Meria Founder) on X',
'url': 'https://x.com/Hasheur/status/...'},
{'date_accessed': '2024-08-15',
'source': 'DGFiP Public Disclosure'}],
'response': {'communication_strategy': 'Public advisory by Meria founder '
'(Owen Simonin) on X (September 20, '
'2024)',
'containment_measures': 'Intrusion contained by end of June '
'2024'},
'stakeholder_advisories': 'Crypto platforms (Binance, Meria) warned users '
'about unsolicited calls. DGFiP acknowledged the '
'breach.',
'title': 'French Crypto Holders Targeted in Sophisticated Phone Scams Fueled '
'by Tax Data Breach',
'type': 'Social Engineering (Phone Scam)',
'vulnerability_exploited': 'Data Breach (Tax Authority Intrusion), '
'Cross-Referenced Leaked Data'}