French prosecutors detain 18-year-old suspect over ZeroBytes tax data theft

Arrests and judicial proceedings

The Paris prosecutor's office announced on Friday, 4 September 2026, that an 18-year-old man had been indicted and placed in pre-trial detention in connection with cyberattacks against the French tax administration. According to judicial authorities, the formal indictment and detention order occurred on 20 August 2026 following investigations into the group operating under the name ZeroBytes. Investigators also detained a second suspect, aged under 16, on 26 August 2026. Police released the younger suspect following his initial custody period, allowing specialized digital forensic services to inspect and extract data from his seized computing hardware. The 18-year-old suspect, identified in judicial proceedings associated with the alias ChatNoir, has faced prior legal action for computer intrusions committed during his youth.

Already known to police services, he had been indicted successively in June 2024 and then in January 2025 in two cases of computer attacks committed in 2023 and 2024, while he was a minor.

Scope of the tax administration breach

The cyberattack involved three distinct computer intrusions carried out across late June and late July 2026 against the Directorate General of Public Finances (DGFiP). According to figures released by the agency, the security breach resulted in the theft of personal and tax records belonging to at least 678,000 individuals and professionals. The stolen files contained sensitive financial and identity records stored within government systems. The DGFiP subsequently initiated an informational notification campaign to directly reach all registered victims. This operation aims to warn affected taxpayers about the elevated dangers of identity theft and fraudulent phishing attempts resulting from the unauthorized extraction of their records.

Expansion of ZeroBytes cyber operations

The intrusions formed part of a broader sequence of illicit digital operations claimed by ZeroBytes across several weeks during the summer of 2026. Judicial statements indicate that the group began posting dark web claims regarding intrusions into state infrastructure and corporate networks on 16 July 2026. On 13 August 2026, ZeroBytes published a specific claim regarding the tax administration files, stating its intention to sell the stolen fiscal data on dark web marketplaces. The hacking group broadened its targets further in mid-August 2026, claiming to have absorbed millions of records from the Ministry of National Education. According to the group's public statements, the compromised educational database contained files belonging to pupils, parents, teaching staff, and administrative workers.

State response and crisis management

The scale of the breach prompted high-level political interventions across the French executive branch. The prime minister convened an emergency crisis meeting to evaluate the vulnerability of administrative networks and coordinate technical defenses among public institutions. A government minister delivered an official apology to taxpayers for the compromise of confidential tax information. Meanwhile, investigative units within the judicial police continue their exploitation of digital evidence seized during the late August arrests. The proceedings against the two young suspects mark the first judicial measures made public in connection with the ZeroBytes infrastructure incursions.