Suspected ZeroBytes hacker detained over DGFiP tax breach as France launches ANSSI-led REACTIV unit

French prosecutors placed an 18-year-old suspected ZeroBytes member in pretrial detention over attacks including the DGFiP tax authority breach — more than 600,000 people affected per The Record, 350,000-678,000 per Infosecurity Magazine — and on Sept. 7…

ZeroBytes claimed attacks on French government agencies, schools and companies starting July 16, including the DGFiP tax authority, which disclosed an August breach exposing names, tax IDs, emails and tax status details. The scale is disputed between sources: The Record reports data of more than 600,000 people, while Infosecurity Magazine cites 350,000-678,000 taxpayers. An 18-year-old with the alias 'ChatNoir' was arrested in the Paris region on Aug. 18 and placed in pretrial detention two days later; a second suspect was arrested Aug. 26 and released (The Record says the suspect is under 16, while Infosecurity Magazine describes the two suspects as aged 16 and 18). The 18-year-old was already under formal investigation for the 2024 Free telecom breach affecting over 19 million customers and for X account takeovers of BFM-TV and RMC linked to the Epsilon collective; the charged offenses carry up to 10 years in prison and a 300,000-euro fine. In response to the breach, France's Prime Minister ordered an extensive audit of ANSSI, and on Sept. 7 ANSSI announced REACTIV (Interministerial Response & Action against Data Breaches), a dedicated incident response capability for French state services that lets ANSSI require ministries to take urgent protective measures for citizens' data and lead centralized technical crisis communications. Its staffing and budget are undisclosed, prompting skepticism about its effectiveness.

• ZeroBytes claimed attacks starting July 16 on French government agencies, schools and companies, including DGFiP, France Travail, SFR, Intermarche and the French Handball Federation.
• The DGFiP breach exposed names, tax IDs, emails and tax status details; sources disagree on scale: The Record reports more than 600,000 people affected, Infosecurity Magazine reports 350,000-678,000 taxpayers.
• An 18-year-old suspect, alias 'ChatNoir', was arrested in the Paris region on Aug. 18 and placed in pretrial detention two days later.
• A second suspect was arrested Aug. 26 and released; The Record says the suspect is under 16, while Infosecurity Magazine says the two suspects were aged 16 and 18.
• The 18-year-old was already under formal investigation for the 2024 Free telecom breach affecting over 19 million customers and for X account takeovers of BFM-TV and RMC linked to the Epsilon collective.
• The charged offenses carry up to 10 years in prison and a 300,000-euro fine.
• The suspect was already under judicial supervision in two prior cyberattack cases.
• ANSSI announced REACTIV (Interministerial Response & Action against Data Breaches) on Sept. 7 as a dedicated incident response capability for French state services.