Loading story…
French police arrested an 18-year-old suspected member of the ZeroBytes hacking collective, known online as “ChatNoir,” in connection with the compromise of France’s Directorate General of Public Finances (DGFiP). Prosecutors said the suspect was arrested on August 18, formally placed under investigation on August 20, and remanded in pretrial detention. A second suspect, younger than 16, was questioned and released; investigators retained that person’s computer equipment for forensic examination.
The DGFiP breach exposed data on more than 678,000 individuals and businesses. Investigators believe the intrusion relied on impersonating internal staff accounts with excessive permissions rather than exploiting a technical vulnerability. DGFiP is urgently deploying USB security tokens to strengthen multifactor authentication as authorities pursue other possible ZeroBytes members. More than 1,200 affected people have joined a GDPR damages action.
See the reporting duties and controls this puts on the clock.
12 events from the most recent confirmed update back to the earliest known activity.
The Paris prosecutor's office publicly disclosed the case involving the suspected ZeroBytes member and the DGFiP data-theft investigation.
Authorities detained and questioned a second suspect under age 16, then released the minor while retaining computer equipment for forensic examination. Authorities did not identify the minor as a ZeroBytes member.
The 18-year-old suspect was formally placed under investigation for organized unauthorized access, data modification/extraction/transmission, and criminal association offenses connected to the DGFiP case. He was remanded in pretrial detention.
French police arrested an 18-year-old Paris-region suspect on suspicion of affiliation with ZeroBytes. French media identified the suspect's online alias as “ChatNoir”; he was already under judicial supervision and had previously faced two formal investigations for alleged cyberattacks committed as a minor.
DGFiP detected a third intrusion in which an attacker exploited a technical vulnerability in a DGFiP-developed statistical-processing deployment system. The incident enabled access to data relating to vacant estates or unclaimed inheritances.
ZeroBytes first claimed on July 16 that it had compromised French public institutions and private companies. Prosecutors subsequently said the suspected campaign targeted government agencies, schools, companies, SFR, Intermarché, and the French Handball Federation, in addition to previously reported targets.
A confidential Senate inquiry found that attackers compromised a National Education employee account, accessed the interministerial RIE network, and then targeted DGFiP's portal and e-contact application. The inquiry identified absent MFA, infostealer-compromised credentials on personal devices, and insecure remote-work access as key weaknesses; ANSSI activated Operation REACTIV to push MFA and hardware security keys across ministries.
ZeroBytes claimed responsibility for the DGFiP data compromise affecting more than 678,000 individuals and professionals. The report also states that the group claimed attacks against France's Education Nationale and France Travail, without providing incident dates or verifiable technical details.
Reporting identified the second DGFiP suspect as Casquette and described Casquette and the suspected ZeroBytes actor ChatNoir as former members of the Epsilon group. The report also linked ChatNoir to prior Epsilon-related proceedings and data-leak activity.
A coordinated GDPR-based compensation action brought together more than 1,200 people affected by the DGFiP compromise, seeking damages from the French state for moral harm and identity-theft prevention costs.
DGFiP began urgently deploying USB tokens to strengthen multifactor authentication for its agents following the account-compromise incident.
A compromise of a critical French Directorate General of Public Finances (DGFiP) database exposed data relating to more than 678,000 individuals and professionals. DGFiP said the intrusion relied on impersonated internal accounts with overly broad permissions rather than a technical exploit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
7 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcezdnet.fr
Open sourcetherecord.media
Open sourcezdnet.fr
Open sourcecyberveille.ch
Open sourcedatabreaches.net
Open sourcezdnet.fr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **ZeroBytes** group has claimed it stole roughly **43 GB** of data from France’s Ministry of National Education and is offering part of the alleged haul for sale on a cybercrime forum. Reporting on the listing says the dataset purportedly contains **346,178,591 raw lines** of data, including school system exports, staff exports from **33 academies**, and two LDAP directory dumps with network account names and **hashed passwords**. The claimed records reportedly map to about **4.35 million staff identifiers** and **1.22 million students** after deduplication, with potentially sensitive information including names, addresses, school records, administrative data, and monitoring records tied to vulnerable or at-risk students. French authorities have not confirmed the full scope of the breach, and the sale claim remains **unverified** because no sample data was publicly released. The ministry said it is still conducting technical analysis, but the incident appears connected to a late-July intrusion in which attackers accessed employee data through a compromised professional account before access was detected and blocked on **July 26**. The ministry has filed a complaint and is coordinating with **CNIL** and **ANSSI** on response and security reinforcement, while the alleged LDAP dumps raise concern that offline cracking of password hashes could enable continued unauthorized access if affected credentials remain valid.
Aug 18, 2026
French authorities arrested a 20-year-old suspect known online as **HexDex** in western France over a broad hacking campaign that prosecutors say is tied to about 100 breach reports filed since late 2025. Investigators said the suspect admitted using the HexDex alias to claim responsibility for intrusions and to publish or repost stolen data on **BreachForum** and **Darkforum**. Police also seized the suspect’s Darkforum account and computer equipment, while forensic analysis and the wider investigation continue. The alleged victims span public institutions, sports federations, and private organizations across France, including multiple national sports bodies, **Logis Hôtels**, **Brit Hotel**, the **Philharmonie de Paris**, food banks, the **Moselle prefecture**, and **e-campus**, a training platform used by the national police. Prosecutors also linked the case to the French Ministry of National Education’s **Compas** database, where a March breach exposed personal data belonging to about **243,000 employees**, and said the suspect is also under scrutiny over a breach involving a government firearms information system. Authorities said a separate cyberattack on **France Titres** detected on April 15 is not currently being attributed to the suspect.
Jun 29, 2026
France’s Ministry of the Economy and Finance confirmed a cyber intrusion into the **Direction générale des Finances publiques (DGFiP)** that exposed data linked to roughly **680,000** individuals and businesses after unauthorized access in late June 2026. Reporting indicates the compromise involved impersonation or misuse of identity and access privileges, with at least **678,437** affected records later advertised for sale on the dark web by an actor calling itself **ZeroBytes**. The exposed population reportedly included both private taxpayers and professionals, and the intrusion was detected during a routine check before access restrictions were tightened. Separate dark-web reporting tied to the same actor alleges a broader compromise of DGFiP-linked cadastral systems affecting **2,041,778** property holders, including land-registry data associating named individuals with fixed addresses and ownership information. Those claims say the attackers used valid credentials and an alleged multi-factor authentication bypass, and that they offered both the stolen data and continued access for sale, although that second breach had not been publicly verified or acknowledged by DGFiP at the time of reporting. The incident raises immediate risk of **phishing**, business email fraud, and other social-engineering attacks using tax, cadastral, and civil-status data.
Aug 20, 2026