Arrests Linked to Cyberattacks Against the French Tax Authority

In June and July 2026, France’s Directorate General of Public Finances (DGFiP) suffered several unauthorized intrusions based on the misuse of credentials belonging to an employee and an authorized third party. The attackers accessed and extracted information before the accounts involved were blocked. The ZeroBytes group subsequently claimed responsibility for the intrusions, which led to an investigation directed by the Paris Public Prosecutor’s Office and the Office for Combating Cybercrime (OFAC).

The intrusions affected data belonging to 678,000 individuals and businesses, including tax, corporate and cadastral information. The DGFiP stated that taxpayers’ personal and professional accounts, as well as their passwords, were not compromised. The authority blocked the accounts involved, preventively restricted access to sensitive systems, notified the CNIL and began contacting affected parties individually, in coordination with ANSSI and other government services.

An 18-year-old suspect was arrested on August 18, formally charged and placed in pretrial detention two days later over his alleged membership in ZeroBytes and involvement in the attacks. A second suspect, who is a minor, was arrested on August 26 and subsequently released, although his devices were seized for examination. The judicial investigation remains ongoing to establish responsibility and identify other possible participants, and no final judgment has been issued.