Tax fraud hack: 16-year-old teenager examined alongside hacker ChatNoir
A second suspect, suspected of being the accomplice of young hacker ChatNoir, has been arrested. The pair is linked to the hacking of 678,000 tax files in June and July.
Second suspect arrested in Zerobytes case
According to huffingtonpost.fr, a teenager under 16 years old was arrested and placed in police custody in the tax fraud hacking case. The public prosecutor's office clarified that he was subsequently released, with investigators now focusing on exploiting his computer equipment. This second suspect is suspected of being the accomplice of the hacker known by the pseudonym ChatNoir, who was examined two days after his arrest on 18 August.
ChatNoir, an 18-year-old man living in Île-de-France, had already been arrested and remanded in custody in Paris. A seasoned hacker known to authorities, he had previously been examined for computer attacks committed in 2023 and 2024 when he was still a minor. He had been under judicial supervision since then. Le Parisien reports that he is the presumed co-founder of the Epsilon collective, a group of hackers who claimed responsibility for hacking the X accounts of BFMTV and RMC in March 2024.
The two young hackers claimed responsibility for the attack under the collective pseudonym Zerobytes, claiming they stole the data in order to resell it. They told the AFP they sold the information for a sum "in thousands of euros", although this claim remains unverifiable. When asked about their motivations, the duo claimed to have no ideological objective, citing simply "money".
The scale of the data theft
The hack of the public finance website took place at the end of June and end of July, resulting in the theft of data from at least 678,000 individuals and professionals, according to the General Directorate of Public Finance (DGFiP). The attack was only revealed to the general public in mid-August, when the Zerobytes group claimed responsibility publicly.
For individuals, the stolen data includes names and forenames, the reference tax income, the family quotient and the source deduction rate. The DGFiP considers information concerning professionals to be "less sensitive". A sample consulted by the AFP contained mainly data on small and medium-sized enterprises, including those of a subsidiary of a major French car equipment manufacturer.
The precision of the files fuels concerns about targeted fraud. In the cybercrime economy, the hacker with access to the system is generally not the one who subsequently exploits the stolen information. Databases are frequently resold to fraud specialists.
Other victims of the Zerobytes group
Beyond the tax authority, the group targeted several institutions and companies. According to the Paris public prosecutor's office, victims of Zerobytes include services from the Ministry of Education, the French Handball Federation, France Travail, the distributor Intermarché and the telecoms group SFR. The Agency for French Education Abroad and the Créteil Academy are also among the affected structures.
Administrative and judicial investigation
The government seized the matter. Sébastien Lecornu requested an audit from the National Agency for Information Systems Security (Anssi), whilst the Minister for Public Accounts David Amiel apologised to taxpayers. For his part, the forum on which the suspect was claiming responsibility for his attacks against the tax authority remained functional on Friday afternoon, although his X account was closed.
The judiciary had opened an investigation in complete discretion as soon as it received the first complaints on 31 July, thus before the public claim of responsibility for the attack. The case, considered sensitive, was entrusted to the Anti-Cybercrime Office (Ofac).
ChatNoir faces a sentence of 10 years' imprisonment and €300,000 fine for a series of cyber-offences, as well as for criminal association. The public prosecutor's office indicated that investigations are continuing under the direction of an examining magistrate to identify and arrest other people involved in the collective.
The tax authority announced that it would contact individually the 678,000 users affected to warn them of possible targeted fraud.
Source: Le Monde - Justice