Key Insights:
- In France, hackers stole information about approximately 50000 Waltio users.
- A cyber unit that prosecutors commissioned to determine the impact and victims.
- Email exposure of tax reports and balances occurred, but funds remained intact.
Waltio’s data breach has prompted French authorities to open a preliminary investigation into the exposure of sensitive user information at the cryptocurrency tax reporting platform, according to statements released by cybersecurity institutions this week.
Extent of the Breach and Activities of the Hackers.
French cybersecurity institutions confirmed that the Paris Public Prosecutor’s Office, through its cybercrime division, instructed the National Cyber Unit of the Gendarmerie to assess the scope of the breach and identify affected users.
The probe is based on reports that a hacking organization gained access to internal systems, stole personal information, and made ransom demands, as it would be concerned about the exposure of financial and identity information related to cryptocurrency activity.
According to Le Parisien, a faction that claimed responsibility for the hack and held Waltio to ransom after hacking user data.
Source: Paris Public Prosecutor’s Office
The hackers reportedly accessed personal information linked to approximately 50,000 users, most of whom are based in France. The group stated that it possessed samples of the stolen data as proof of the breach.
Moreover, French cybersecurity officials reported that investigations are underway to determine how the intrusion occurred, the extent of the data disclosure, and the type of information stolen.
Waltio officially alleged that it had been the victim of an attempted extortion and an intrusion into an automated data processing system, which began the litigation that has resulted in the present investigation. However, Waltio further claimed that its technical infrastructure was unaffected and that its clients’ funds were not at risk.
The company’s disclosure aimed to explain which specific types of data were accessed, although sensitive financial credentials and official identification records were not part of the compromised datasets.
Law Enforcement and Regulatory Environment.
The inquiry follows the growth of interest in crypto-related information leaks in France.
During the previous year, the French police have reported several home invasions, kidnappings, and attempted kidnappings by offenders who are targeting people who possess digital assets.
Additionally, French authorities have warned crypto companies about compliance obligations under the European Union’s Markets in Crypto-Assets Regulation (MiCA). Under the framework, companies are required to notify regulators whether they intend to apply for a MiCA license or to wind down operations in France.
Nevertheless, the transitional phase ends on June 30, after which companies that fail to comply with the new regulations will face regulatory penalties.
The Waltio incident has no direct links to compliance with MiCA. Nevertheless, it is conducted within a broader regulatory framework designed to control and secure personal information and to establish work standards for crypto service providers in the EU.
Physical Security Threats and Cases
A French police warning warns of targeted crimes against crypto users. The officials have been cautious that when a person’s personal information is exposed, they may be at risk of being kidnapped, arrested unlawfully, and even blackmailed by using their family members to compel her/him to share digital properties.
According to the French police, such attacks are sometimes called wrench attacks, a term that describes physical coercion used to obtain or reveal private keys or to force crypto transfers. In France and other countries, such crimes have been reported, and criminals have been observed using personal information associated with crypto ownership.
Company Overview and Industry Analysis.
In addition to the report, Waltio has approximately 150,000 users and specializes in crypto tax compliance for investors in Europe, particularly France, Spain, and Belgium.
The platform consolidates transaction data across over 700 exchanges, wallets, and blockchains to compute capital gains, losses, and staking income, and to generate tax-compliant reports for local submission.
Earlier this month, hardware wallet manufacturer Ledger disclosed that a breach at third-party payment processor Global-e exposed customer data. In a separate incident last month, crypto tax software provider Koinly notified users of a potential email data breach linked to a third-party analytics platform.
