French Prosecutors Charge 18-Year-Old Over Massive Tax Authority Hack Linked to ZeroBytes

The Parquet de Paris confirmed on Friday, 4 September, that an 18-year-old suspect has been indicted and placed in pretrial detention over the hack of the DGFiP, France's tax administration, which exposed hundreds of thousands of taxpayer records earlier this year. A second suspect, under 16 years old, was released after police custody, though investigators retained the minor's computers.

The 18-year-old is believed to be linked to the hacker group ZeroBytes and had already faced indictment on two prior occasions, in June 2024 and January 2025, according to the prosecutor's office.

What the hack exposed

The DGFiP acknowledged the intrusions on 13 August, saying attackers had breached its systems on two separate occasions, at the end of June and again at the end of July. In total, some 678,000 tax files were accessed. The leaked data included names, birth dates, addresses, reference fiscal income and source withholding tax rates.

The incident follows an earlier breach in February involving FICOBA, the national register of bank accounts, in which 1.2 million bank accounts linked to the DGFiP were exposed.

A group with a track record

ZeroBytes had previously claimed responsibility for attacks on the supermarket chain Intermarché and the French Handball Federation. Following the DGFiP breach, the group posted a message on X reading: "Les impôts, c'était que le début" — roughly, "Taxes were only the beginning."

For European crypto holders, breaches of this scale carry particular weight. Leaked fiscal data, including income levels and addresses, has repeatedly been used by criminals to identify and target individuals suspected of holding significant crypto assets, a pattern authorities across the continent have flagged in recent years amid a rise in violent extortion attempts against known holders.

The DGFiP has not detailed what remediation steps it is taking for affected taxpayers, and the investigation into ZeroBytes' broader activities continues. The Paris prosecutor's office has not indicated whether further arrests are expected.