Cyber Threat Actor: ZeroBytes

ZeroBytes is a threat actor known by that alias and is located in France. Public reporting describes the group as a self‑proclaimed hacking duo. The actor came to public attention following a breach disclosed in mid‑2026. On 2026‑06‑01 the group gained unauthorized access to the French tax authority’s internal systems. The intrusion resulted in the exfiltration of extensive datasets covering individual and business tax records as well as land‑registry information.

In addition to tax and land data, the attackers said they obtained records pertaining to landowners, students and teachers. The actors claimed to have sold the stolen material for thousands of euros, indicating a financially motivated objective. The targeting of a national revenue agency suggests a focus on governmental institutions within France. No public evidence links the activity to espionage, disruption or any other strategic goal beyond the monetary gain described by the actors themselves. The incident prompted the French government to announce new cybersecurity measures in response to the breach.

Public sources do not detail the specific malware families, exploit tools or initial‑access vectors used by ZeroBytes in this operation. Consequently, any description of their tooling style or technical tactics remains unspecified in the available reporting. Attribution to a state sponsor or to a larger criminal consortium has not been established by credible public sources. The group is therefore understood to operate as an independent pair of actors acting under the ZeroBytes moniker. The 2026 tax authority breach stands as the sole publicly reported campaign attributed to ZeroBytes at this time. Until further technical details emerge, the profile of ZeroBytes rests on the confirmed facts of the French tax intrusion and the actors’ own statements about data sale.