Risk of data leaks and crypto kidnappings

The Conseil d’État’s improbable answer to our request to freeze DAC8, six weeks after four break-ins in the tax administration’s servers

On 14 September 2026, the Conseil d’État (the highest administrative court in France) refused to suspend the decree applying DAC8 in France, the text requiring crypto-asset platforms to report to the tax administration, every year, the identity, home address and complete transaction history of every one of their users.

We had requested a temporary freeze of this decree through a référé-suspension (an application for interim suspension), while the courts examine its legality. Such a request requires demonstrating two things: that the text is likely illegal, and that there is an urgency to suspend it pending a final decision. The judge decided only the second. He states in terms that he is dispensing with the first. Our arguments on the lawfulness of the decree therefore stand untouched, before the action for annulment initiated since February 2026.

But the reason for the refusal itself calls for a response:

The applicant companies further fail to establish how holding this data in a register centralising all transaction data of all residents of Member States of the Union would be such as to heighten the risk of its being compromised, quite apart from the fact that the bare possibility of a risk whose probability of occurring is very low (« très faible ») cannot amount to a situation of urgency.

Conseil d'État, order of the interim relief judge, 14 September 2026, no. 519158

Two assertions. The first: we failed to show how centralising this data makes a leak more likely. The second: the probability of such a leak is “very low” (très faible).

This is what our case file contained. Not one of these facts has been disputed by the State.

Download our application to suspend the decree, 26 August 2026 PDF, 25 pages, 7.7 MB Download order no. 519158 of 14 September 2026 Official text on conseil-etat.fr

1. The timeline

Our request was filed on 26 August 2026. Here is what preceded it.

18 February 2026. The Direction générale des finances publiques (DGFiP, the French public finances directorate) suffered an attack on the national register of bank accounts. By simply misusing one civil servant’s credentials, the attacker read the bank details, the identity of the holder, their address, and sometimes their tax identifier for 1.2 million accounts.

15 April 2026. The Agence nationale des titres sécurisés (ANTS, which issues official identity documents): 11 to 19 million accounts affected.

12 August 2026. The ministry disclosed an intrusion that had taken place in late June into the DGFiP systems: 678,000 individuals and professionals, with the reference taxable income, civil status, family situation and postal address.

13 August 2026. Second intrusion, in late July: cadastral data of 433,485 individuals.

18 August 2026. Third intrusion: inheritance data, scale undisclosed. On the same day, at a press conference, the director general of the DGFiP announced a fourth intrusion, detected the day before. Minister David Amiel, after apologising to taxpayers, said: “Our information systems have weaknesses.”

26 August 2026. We filed our application for suspension.

11 September 2026. Three days before the order, the Parquet national anticriminalité organisée (the national prosecution service for organised crime) released its latest figures on kidnappings and unlawful confinements linked to crypto-assets.

14 September 2026. The judge held the probability of these data being compromised to be “very low” (très faible).

Four intrusions on the record, acknowledged by the minister himself, in the six weeks preceding the application. And, more broadly: the CNIL (the French data protection authority) recorded 5,629 personal data leaks in 2024, up by 20%, then by another 10% in 2025, the most affected sector being that of public administrations, accounting for 19% of the total alone.

2. Why centralisation aggravates the risk

The judge writes that we do not explain “how”. We had done so, in four ways.

A target is worth what it yields. DAC8 provides for all these data to be poured into a single European directory, hosted by the Commission, which will aggregate the transactions of all residents of the Union. Such a register is worth incomparably more, for an attacker, than the databases kept separately by each platform, and the resources devoted to breaking it will rise accordingly. This is not our intuition: the Agence nationale de la sécurité des systèmes d’information (ANSSI, the national cybersecurity agency) writes it in black and white in its August 2024 recommendations: “Infrastructures are targeted because of the concentration of data and processing they host […]”. To concentrate is to raise the return on the attack.

A single point of failure. By replacing compartmentalised exchanges between States with a single warehouse, a point of failure is created whose compromise exposes everything, all at once. The directive does provide that each State only accesses the data of its own residents, but this is a software barrier, not a cryptographic protection: no end-to-end encryption is planned. The security of the scheme therefore rests on the assumption that legitimate credentials will never be turned against it. This is exactly what happened at the DGFiP in February 2026.

A transfer of custody. The decree organises the movement of these data from companies that have suffered no intrusion since their creation, Paymium in 2011, Bull Bitcoin in 2013, to administrations whose compromises are massive, repeated and documented, and then to a single European directory. That move alone changes the risk. The order does not say a word about it.

The danger also comes from within. In January 2026, the press revealed the indictment of tax agents for having consulted and transmitted information on the wealth of people active in the crypto-asset sector. Widening the pool of data that can be looked up widens that risk too, mechanically.

3. The tax authority says exactly the opposite of the judge

In February 2026, before Parliament, the DGFiP, the very administration to which this decree orders these data to be transmitted, opposed a mandatory declaration of crypto-asset wallets, in these terms:

A generalised declaration of these wallets would lead to the centralisation of very sensitive data, such as the identity of the holders and the value of their assets […] in a context of frequent cyberattacks against large databases, this information would become a prime target for hackers, with increased risks of fraud.

DGFiP, remarks reported before the National Assembly, session of 26 February 2026

The demonstration that the judge finds missing from our case file was therefore made by the French tax administration itself, six months earlier, before the deputies, and to draw the opposite conclusion to that imposed by the decree.

We did not ask the Conseil d’État to take our word for it. We asked it to take the tax administration’s word.

4. What is really at stake

The data in question associates a name, a home address and the precise amount of a crypto-asset portfolio. However, these assets are transferred instantly, from person to person, in an irreversible manner: holding them is closer to keeping gold or cash at home than to holding a bank balance. Such a leak does not merely expose you to fraud. It exposes you to being beaten.

This is not a hypothetical.

The national prosecutor for organised crime recorded, as of 24 April 2026, 135 kidnappings or cases of unlawful imprisonment targeting this sector since 2023: 18 in 2024, 67 in 2025, and already 47 in the first months of 2026. As of 30 June 2026, the Ministry of the Interior counted 77 in the current year alone, one every two and a half days in France. In January 2026, the Parquet de Paris (the Paris public prosecutor’s office) published a press release warning that following data leaks in the sector, “in the most serious situations, criminals can go so far as to threaten and physically assault victims or their close entourage to extort them”.

And because a figure will never say what a fact says: in June 2026, a couple had just bought a house in the Somme department. In less than a month, they suffered three intrusions into their home, by three different teams of criminals, sometimes accompanied by violence. The house had belonged to a couple holding a significant portfolio of crypto-assets, whose tax assessment notice had reportedly leaked according to the victims’ lawyer. The new owners, however, did not own a single cent of cryptocurrency.

In practice, it is the families who end up on the front line.

This is what a leak of wealth data held by the tax administration looks like in practice. It is not a harm that a court decision repairs two years later. In the Somme case, it even survived the sale of the house: the data itself goes on circulating.

5. The four silences of the decision

Irreversibility. Once the data is collected, transmitted to the tax authorities, poured into the European directory and then exchanged between States, no annulment will restore its confidentiality. The timetable is already set: European directory before 31 December 2026; collection of the identity of all existing clients before 1 January 2027; first declaration to the tax authorities on 15 June 2027; first exchange between States on 30 September 2027. However, our action on the merits involves referring the matter to the Court of Justice of the European Union, which takes years. The judge on the merits will therefore, in all likelihood, only rule once these deadlines have passed. Suspension was the only way to stop our case becoming moot. The order does not address this point, which is nevertheless the very definition of urgency.

A one-sided balance. The judge opposes the public interest attached to the fight against tax evasion. Yet one must measure what a suspension would really cost it. Our case file set it out: the administration retains all of its existing tools, declaration of capital gains, declaration of accounts held abroad, right of communication, international mutual assistance. The fight against fraud is in no way disarmed by a few months of freezing. That side of the scales was never weighed.

An identical precedent, ignored. In July 2016, this same interim relief judge had suspended the decree organising the consultation of the register of trusts, a tax transparency mechanism relating to wealth data. The Constitutional Council then ruled the mechanism contrary to the Constitution, as constituting a manifestly disproportionate infringement of privacy. Urgency was recognised there even though the harm was still only possible. The order does not distinguish this precedent. It does not cite it.

Its own case law, brushed aside in a sentence. The judge sweeps aside the idea that a violation of European law could, on its own, justify urgency. Yet this is what the Conseil d’État’s own interim relief judge ruled in 2013, in line with consistent European case law. Here again: neither cited, nor discussed, nor distinguished.

6. Rejected without a hearing, without the State having to respond

The decision was rendered according to a filtering procedure that authorises the judge to reject a request without investigation and without a hearing when they consider the urgency not to be established.

Consequence: the State never had to explain itself. The intrusions at the DGFiP, the position of the DGFiP before Parliament, the figures from the CNIL, those from the justice system and the Interior, the opinion of the ANSSI, the Somme case, none of this was contradicted by the opposing party. These facts were simply declared insufficient, without debate, without us being able to explain ourselves orally, and without the decision indicating what, in twenty-five pages and eighteen sources, was lacking.

We impute nothing to anyone. We record this: a case file built on public, undisputed facts, emanating essentially from the State itself, was dismissed by means of an assessment, “very low” (très faible), which nothing in the decision supports, and which the news of the preceding weeks directly contradicted.

7. What comes next

This refusal settles nothing. The judge refrained from examining our arguments on the legality of the decree: they are intact. Our action for annulment, filed on 24 February 2026 and completed in May, is taking its course. It requests in particular that the Court of Justice of the European Union rule on the validity of the DAC8 directive itself. This interim application was only one among those we have initiated, and not the last. We are conducting this litigation on several fronts; we will publish the details when we can.

We will not be made the instruments of an irresponsible State that puts its own citizens in danger. This is upside down: the financing of public action cannot give itself means that contravene the accomplishment of its most fundamental mission. That the Conseil d’État should brush aside such a request, and trivialise such a failure of sovereign functions even though it is supposed to ensure the legality of public action, is in our eyes a regrettable and worrying situation. But this can only strengthen our resolve to pursue this fight by all means: liberty, security and resistance to oppression are at the heart of the Constitution of the French Republic, and if the institutions supposed to guarantee them fail, it becomes imperative to remind them of their duty and the meaning of their mission.

Download our application

We are publishing our request for suspension and the decision that rejected it. Our case on urgency must be open to examination, criticism and verification by anyone.

Application to suspend the decree Filed on 26 August 2026 before the Conseil d'État · PDF, 25 pages, 7.7 MB Order no. 519158 Decision of the interim relief judge, 14 September 2026 · Official text on conseil-etat.fr

Order no. 519158 of 14 September 2026, interim relief judge of the Conseil d’État. Action on the merits: application no. 513141.