French prosecutors confirm arrest of suspected ZeroBytes hacker behind tax cyberattack
French authorities have arrested an 18-year-old suspected member of the ZeroBytes hacking group linked to a series of cyberattacks targeting French government agencies, including the tax authority (DGFiP). The group, known for attacks since mid-July, is believed to have compromised over 600,000 people's data, including sensitive tax information. This arrest follows a pattern of investigations into the group's activities, including a previous breach of a French telecommunications provider and attacks linked to the Epsilon collective.
French authorities have detained an 18-year-old suspected member of the ZeroBytes hacking group over cyberattacks targeting the country's tax authority and other organizations, the Paris prosecutor's office confirmed to Recorded Future News. The arrests are part of an investigation into ZeroBytes, a French-speaking hacking group that has claimed attacks on French government agencies, schools and companies since mid-July.
Prosecutors said the 18-year-old is suspected of being a member of the group and participating in attacks against the Directorate General of Public Finances, or DGFiP, which disclosed a data breach in August. The tax authority previously said an attacker gained unauthorized access to its systems in late June by stealing or misusing someone’s identity, allowing them to view and extract information belonging to individuals and businesses.
According to French media reports, one of his previous cases involved attacks linked to the hacker collective Epsilon, including the takeover of X accounts belonging to French broadcasters BFM-TV and RMC and the theft of data from several companies. The other involved the massive 2024 breach of French telecommunications provider Free, in which information belonging to more than 19 million customers was reportedly stolen.
The 18-year-old was already known to French authorities. Prosecutors said he had been formally placed under investigation in June 2024 and again in January 2025 in two separate cases involving cyberattacks allegedly carried out while he was a minor. He remained under judicial supervision in both cases when he arrested last month. French media have identified the suspect by the online alias “ChatNoir,” though authorities have not publicly disclosed his civilian identity.
In the ZeroBytes case, prosecutors are investigating him for several alleged offenses, including organized unauthorized access to computer systems containing personal data, stealing and modifying data, participating in a criminal conspiracy and refusing to provide authorities with a decryption key. The alleged offenses carry penalties of up to 10 years in prison and a €300,000 fine, prosecutors said. ZeroBytes first claimed attacks on July 16, writing that on a dark web site that they had compromised both French public institutions and private companies. The group is also suspected of targeting several French educational institutions, employment agency France Travail, telecom operator SFR, retailer Intermarché, the French Handball Federation and other organizations. French authorities have been grappling with a wave of cyberattacks and data breaches affecting government agencies and other organizations. Earlier this year, hackers targeted France's National Agency for Secure Documents, which handles applications for passports and other identity documents, while a separate breach of an Education Ministry system exposed students' personal information.