Hacker penetrates police and justice servers to defraud notaries — up to 1 million euros
A 25-year-old Parisian exploited a flaw in police and judicial servers to usurp the identities of judges and police commissioners. The estimated loss reaches up to one million euros.
A 25-year-old Parisian charged after hacking government servers to defraud notaries and businesses
A young man of 25 years old, with a degree in computer engineering and residing in Paris, has been charged with fraud and money laundering in an organised gang and placed in provisional detention. According to frenchbreaches.com, the suspect allegedly exploited a computer flaw in servers belonging to the police and the judiciary in order to conduct a vast campaign of fraud targeting notably notarial offices, businesses and associations. The damage is currently estimated at between 150,000 and one million euros.
A vulnerability in state infrastructure as a point of entry
During his interviews, the suspect explained to investigators that he had discovered a vulnerability in government servers. This breach allegedly allowed him to access unused official email addresses from the domains of the police and the judiciary. By sending his messages from these addresses, he gave his communications an institutional appearance capable of deceiving recipients, who believed they were corresponding with genuine representatives of the law enforcement or judicial authorities.
Usurpation of the identity of prosecutors, judges and commissioners
For approximately one year, the young man is suspected of having assumed the identity of police commissioners, judges and, occasionally, bankers. Among the usurped identities were notably those of prosecutors. Victims received emails or calls informing them that they were the subject of an investigation concerning alleged illicit funds, and were invited to rapidly contact their correspondent.
Between May and July 2025, companies, associations, notarial offices and auction houses allegedly received such communications. In one reported case, an institution transferred more than 88,000 euros to a Portuguese bank account, convinced it was funding an official escrow account.
Virtual telephone switchboards to reinforce the deception
The operation did not rely solely on emails. The fraudsters allegedly also used virtual telephone numbers and switchboards configured to simulate official services, thereby strengthening the credibility of their approaches. Fraudulent SMS messages were also reportedly sent as part of false banking adviser operations, prompting victims to call back and then make transfers. The diverted funds were subsequently directed to accounts located in Portugal and Spain.
Arrest at his mother's home, following telephone line tracing
Investigators succeeded in identifying the suspect by analysing the telephone lines and bank accounts used during the phishing campaigns. The young man was finally arrested at his mother's home in Paris. According to information reported by Le Parisien and taken up by frenchbreaches.com, he allegedly attempted to hide before being located by police officers. During the intervention, 4,000 euros in cash, three mobile phones and a computer were seized.
Admissions and technical cooperation in custody
During his custody, the suspect allegedly admitted to the facts. He claims to have provided investigators with access to his equipment and servers, and to have explained to them the method of exploiting the flaw so that it could be corrected. The exact amount of the diverted sums remains under evaluation, with the investigation continuing notably to identify any possible accomplices.
This case highlights the risks associated with the compromise of institutional infrastructure: by relying on government email addresses and the identities of judges, the perpetrators allegedly succeeded in deceiving professional structures nevertheless accustomed to handling sensitive financial flows.
Source: Google News MA — Crime (fr)