French prosecutors confirm arrest of suspected ZeroBytes hacker behind tax cyberattack

French prosecutors confirm arrest of suspected ZeroBytes hacker behind tax cyberattack

French authorities detained an 18-year-old suspected member of the ZeroBytes hacking group over cyberattacks targeting the country's tax authority and other organizations, the Paris prosecutor's office confirmed to Recorded Future News.

The suspect was arrested in the Paris region on August 18 and placed in pretrial detention two days later. A second suspect, who is under 16, was arrested on August 26 and later released while investigators examine his devices, prosecutors said Tuesday in response to a media inquiry.

The arrests are part of an investigation into ZeroBytes, a French-speaking hacking group that has claimed attacks against French government agencies, schools and companies since mid-July.

Prosecutors said the 18-year-old is suspected of being a member of the group and participating in attacks against the Directorate General of Public Finances, or DGFiP, which disclosed a data breach in August.

The tax authority previously said an attacker gained unauthorized access to its systems in late June by stealing or misusing someone’s identity, allowing them to view and extract information belonging to individuals and businesses.

A hacker using the ZeroBytes name later claimed to have stolen information on more than 600,000 people, including names, tax identification numbers, email addresses, family circumstances and details about their tax status.

Well-known suspect

The 18-year-old was already known to French authorities. Prosecutors said he had been formally placed under investigation in June 2024 and again in January 2025 in two separate cases involving cyberattacks allegedly carried out while he was a minor. He remained under judicial supervision in both cases when he was arrested last month.

French media have identified the suspect by the online alias “ChatNoir,” though authorities have not publicly disclosed his civilian identity.

According to French media reports, one of his previous cases involved attacks linked to the hacker collective Epsilon, including the takeover of X accounts belonging to French broadcasters BFM-TV and RMC and the theft of data from several companies.

The other involved the massive 2024 breach of French telecommunications provider Free, in which information belonging to more than 19 million customers was reportedly stolen. The suspect was placed under formal investigation in that case in January 2025.

In the ZeroBytes case, prosecutors are investigating him for several alleged offenses, including organized unauthorized access to computer systems containing personal data, stealing and modifying data, participating in a criminal conspiracy and refusing to provide authorities with a decryption key.

The alleged offenses carry penalties of up to 10 years in prison and a €300,000 fine, prosecutors said.

ZeroBytes first claimed attacks on July 16, writing that on a dark web site that they had compromised both French public institutions and private companies, authorities said.

The group is also suspected of targeting several French educational institutions, employment agency France Travail, telecom operator SFR, retailer Intermarché, the French Handball Federation and other organizations.

French authorities have been grappling with a wave of cyberattacks and data breaches affecting government agencies and other organizations.

Earlier this year, hackers targeted France's National Agency for Secure Documents, which handles applications for passports and other identity documents, while a separate breach of an Education Ministry system exposed students' personal information.

Earlier this year, French police arrested a 20-year-old suspected of carrying out dozens of breaches involving government agencies, sports federations and private businesses.