French crypto lobby Adan files CNIL complaint over tax data breaches affecting holders

The French crypto industry association Adan said on October 12 that it had filed a report with the CNIL, France's data protection authority, over breaches at the tax administration that it says may have exposed crypto holders and their families to heightened risk.

The move follows a letter Adan sent to the Ministry of Economy and Finance, known as Bercy, in March. That letter went unanswered, the association said, prompting it to escalate the matter directly to the CNIL in order to seek verification that adequate protections are in place for actors in the crypto sector and their families.

Adan was assisted pro bono in preparing the complaint by the law firm ORWL, with lawyers Romain Chilly and Hugo Ferraris working on the file.

The FICOBA breach

At the centre of the complaint is a breach of FICOBA, the national file of bank accounts, which the DGFiP, France's tax administration, disclosed on February 18, 2026. According to the DGFiP, an attacker usurped a civil servant's credentials to gain access to part of the file.

The administration has said 1.2 million accounts were concerned by the intrusion. Data exposed included identities, addresses and bank account details of the account holders affected.

A parliamentary response published on June 9 indicated that the fraudulent access took place between late January and February 13. The government subsequently restored partner access to the file on March 23, though with more restricted permissions than before the breach.

A separate investigation into a tax agent

Adan's complaint also points to a second, separate matter involving the DGFiP. ORWL has reported that a DGFiP agent was placed under formal investigation, known in France as a mise en examen, in June 2025.

The agent is suspected of transmitting confidential taxpayer information, including data concerning crypto investors, to third parties.

Adan's filing with the CNIL groups both episodes together, framing them as part of a broader pattern of exposure for crypto holders whose financial and tax data sits within government systems. The association is seeking confirmation from the regulator that protections for the sector and for the individuals whose data was potentially compromised are being properly enforced.

Bercy has not responded publicly to Adan's original March letter or to the CNIL filing.