French Authorities Arrest Suspected ZeroBytes Hacker in Tax Authority Cyberattack

Arrest of Suspected ZeroBytes Member

French authorities have arrested an 18-year-old individual suspected of being a member of the ZeroBytes hacking group. The arrest occurred on August 18 in the Paris region, and the suspect was placed in pretrial detention two days later. A second suspect, under 16, was also arrested on August 26 but later released as investigators examine their devices.

Investigation into Cyberattacks

These arrests are part of an ongoing investigation into ZeroBytes, a French-speaking hacking group that has claimed responsibility for cyberattacks against French government agencies, schools, and companies since mid-July. The 18-year-old is suspected of participating in attacks against the Directorate General of Public Finances (DGFiP), which reported a data breach in August.

DGFiP Data Breach Details

The tax authority previously stated that an attacker gained unauthorized access to its systems in late June by stealing or misusing an identity. This allowed the attacker to view and extract information belonging to individuals and businesses. A hacker using the ZeroBytes name later claimed to have stolen data on over 600,000 people, including names, tax identification numbers, email addresses, family circumstances, and tax status details.

Prior Investigations and Connections

The 18-year-old suspect was already known to French authorities, having been under investigation in June 2024 and January 2025 for separate cyberattack cases allegedly carried out while he was a minor. French media have identified the suspect by the online alias “ChatNoir.” Previous cases reportedly involved attacks linked to the Epsilon hacker collective, including X account takeovers and data theft, and the 2024 breach of French telecommunications provider Free, which affected over 19 million customers.