Press play to start listening
French authorities have detained an 18-year-old man suspected of belonging to ZeroBytes, a hacking group that claimed responsibility for several attacks targeting French government services and companies.
The Paris prosecutor’s office disclosed the case on September 4, according to reports from French media. However, the suspect was arrested on August 18, formally placed under investigation on August 20 and remanded in pretrial detention.
A second suspect, aged under 16, was detained on August 26 and later released after questioning. Investigators retained his computer equipment for examination. Authorities have not identified him as the second member of ZeroBytes.
Suspect Investigated Over DGFiP Attacks
The older suspect is being investigated for organized unauthorized access to computer systems, fraudulent extraction and possession of data, and participation in a criminal association. The investigation is being handled by France’s Office Anti-Cybercriminalité (OFAC).
Le Monde reported that the suspect is known online as “ChatNoir” and had already been placed under formal investigation in two cases involving cyberattacks committed while he was a minor. He was under judicial supervision when police arrested him in August. The suspect has not been convicted.
The latest case concerns breaches into systems operated by France’s Directorate General of Public Finances (DGFiP). The attacks occurred in June and July and used compromised credentials belonging to a DGFiP employee and an authorized third party.
The DGFiP confirmed that information belonging to 678,000 individuals and professionals was accessed and extracted. The stolen information included names and tax details such as reference income, family quotient and withholding-tax rates. Business names and SIREN identification numbers were also affected.
The tax authority said passwords belonging to individuals and businesses were not compromised, and neither the public impots.gouv.fr website nor users’ personal tax spaces were breached. Some cadastral information concerning property addresses and sizes was viewed.
ZeroBytes Account Banned From PwnForums
ZeroBytes presented itself publicly as a French hacking duo. One member communicated through the now suspended @ZeroBytesG account on X, posted breach claims on PwnForums and reportedly spoke with journalists through Telegram. Public information about the second member and their technical role remains limited.
Hackread.com reviewed the ZeroBytes account and its historical threads on PwnForums. The profile is now permanently banned, with “Arrested” displayed as the reason and a link to Franceinfo’s report.
However, as seen by Hackread.com, the ZeroBytes forum account remained active after the 18-year-old was detained, continuing to post data samples and claim attacks until September 2. That activity does not establish who controlled the account, but it supports the authorities’ decision to continue investigating other suspected participants.
Forum search results show that the account posted or advertised datasets it claimed came from the DGFiP, SFR, Intermarché, France’s National Education system, the French Handball Federation, Sport 2000, Bureau Vallée, AEFE, Accor and other organizations.
The record totals accompanying those posts remain claims made by the account and should not be treated as confirmed numbers. However, the Paris prosecutor listed education services, France Travail, the French Handball Federation, Intermarché, SFR, Bureau Vallée and Pulsy among organizations affected by activity attributed to ZeroBytes.
Another French Hacker Arrest
The arrest follows the detention of another French hacker approximately four months earlier. In April, French police arrested a 20-year-old known as HexDex, who was accused of stealing and publishing data from government agencies, sports organizations and private companies.
No public evidence connects the HexDex and ZeroBytes cases. Both investigations, however, involve young suspects accused of advertising or releasing stolen French data through cybercrime forums.
