Tax office hack: 18-year-old hacker held in custody, 678,000 taxpayers affected
A suspected member of the Zerobytes hacking group, aged 18, has been charged and imprisoned for stealing tax data belonging to 678,000 people. A second minor suspect has been released.
Recidivist 18-year-old hacker remanded in custody for massive French tax office breach
France 24 reports that a 18-year-old man, residing in the Paris region and suspected member of the Zerobytes hacking group, has been charged and remanded in custody in Paris for the theft of tax data belonging to 678,000 taxpayers.
The arrest took place as early as 18 August, before the group even publicly claimed the attack, and the charging followed two days later. A second suspect, aged under 16, was also arrested and placed in police custody before being released. Investigators will now analyse the computer equipment seized during this arrest. His lawyer, Me Reda Ghilaci, refused to comment on the case.
The breach occurred in two waves, at the end of June and end of July, but was not made public until mid-August, when Zerobytes — a group presenting itself as a duo — claimed responsibility. The directorate general of public finances (DGFiP) confirmed the theft of data belonging to at least 678,000 individuals and professionals.
A profile already known to judicial authorities
The 18-year-old suspect is not facing charges for the first time. He had already been charged on two previous occasions for computer attacks committed in 2023 and 2024, when he was still a minor, and was under judicial supervision at the time of the offences. In this new case, he faces up to ten years' imprisonment and a fine of €300,000 for a series of cybercrime offences as well as conspiracy. His lawyers, Mes Camille Lucotte and Sofia Massou, declined to comment.
The investigation, deemed sensitive, was entrusted to the Anti-Cybercrime Office (Ofac) as early as 31 July — the date the first complaints were received — even before any public claim of responsibility for the attack. The public prosecutor's office responsible for combating cybercrime clarified that investigations are now continuing under the supervision of an investigating judge, in order to identify and arrest the other members of the group.
Government responds, many victims affected
In response to the scale of the incident, the government reacted swiftly. Defence Minister Sébastien Lecornu requested an audit from the National Agency for the Security of Information Systems (Anssi) and called for the creation of a "new unit" to combat cyberattacks. Public Accounts Minister David Amiel apologised to the affected taxpayers.
Among the victims of the group are, according to the Paris public prosecutor's office, the Education Ministry services — the Créteil Academy and the Agency for French Education Abroad — France Travail, the French Handball Federation, the Intermarché distributor and the telecommunications group SFR.
Sensitive data and targeted fraud risks
The information stolen from individuals includes names, tax reference income, family quotient and tax withholding rate. Data concerning professionals is deemed "less sensitive" by the DGFiP.
In mid-August, Zerobytes claimed to AFP that it had resold the stolen data for a sum "running into thousands of euros", a claim that cannot be verified. When questioned about its motivations, the duo evoked "money, I suppose", without specifying any particular objective.
The precision of the files has raised fears of targeted fraud. In the cybercriminal economy, the hacker who breaks into a system is generally not the one who will exploit the stolen information: databases are often resold to fraud specialists. The DGFiP announced that it would contact affected users individually to warn them of this risk.
A worrying trend among minors
The public prosecutor's office responsible for cybercrime has noted in recent months "a surge in minors committing offences" in this field. Its director, magistrate Johanna Brousse, called for "deconstructing the myth of the hacker hero" in an interview with AFP. The forum on which Zerobytes claimed its attacks was still accessible on Friday afternoon, whilst its X account, used to taunt the authorities, had been closed.
Source: France 24 - France