Direction Générale des Finances Publiques

Summary

French authorities arrested an 18‑year‑old suspected member of the ZeroBytes hacking group for cyberattacks that targeted the Directorate General of Public Finances and other public and private entities, compromising personal and tax data of hundreds of thousands of individuals and businesses. The suspect, already known to police for prior offenses, was detained after investigators linked him to the theft of names, tax identifiers, email addresses and financial details, which the group claimed to have sold for profit.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In June 2026, the Directorate General of Public Finances (DGFiP) detected unauthorized access to its computer systems, which officials later said resulted from the theft or misuse of an individual's identity. A first breach compromised details from more than 678,000 individual and professional accounts, including names, income reference data and tax rates paid. A second breach in July exposed information from 200,000 land registry accounts.

The hacking group ZeroBytes claimed responsibility for both intrusions on a dark‑web forum, stating they had accessed a VPN used by tax officials and had stolen data on more than 600,000 people, comprising names, tax identification numbers, email addresses, family circumstances and tax status details. ZeroBytes also asserted they possessed details on 250,000 land registry accounts covering about two million property owners and said they had obtained information on millions of students and tens of thousands of teachers, some dating back two decades. The group told AFP that the stolen data had already been sold to two individuals for thousands of euros and cited money as a possible motive.

French prosecutors announced the arrest of an 18‑year‑old suspected member of ZeroBytes on August 18, 2026, placing him in pretrial detention two days later; a second suspect under 16 was arrested on August 26 and later released while investigators examined his devices. The 18‑year‑old, known online as ChatNoir, had previously been placed under formal investigation in June 2024 and January 2025 for separate cyberattack cases and was under judicial supervision at the time of his arrest. Authorities allege he participated in organized unauthorized access to personal data systems, data theft and modification, criminal conspiracy and refusal to provide a decryption key, offenses punishable by up to ten years imprisonment and a €300,000 fine.

In response to the breaches, DGFiP head Amélie Verdier noted a third data breach detected on Monday that was still under evaluation, while Prime Minister Sébastien Lecornu directed the National Cybersecurity Agency to create a new cyber unit to counter such attacks. Budget Minister David Amiel stated that his ministry would employ artificial intelligence tools to test the cybersecurity vulnerabilities of government agencies following the disclosures. French officials also referenced earlier incidents involving the National Agency for Secure Documents and the Education Ministry as part of a broader wave of cyberattacks targeting public sector systems.

Sources

Sources available to members: 2 sources.