'ChatNoir,' the 18-year-old behind the hacking of a French tax website
French authorities have indicted an 18-year-old man in connection with one of the most significant cyberattacks on the country's tax system, which compromised the personal information of 678,000 taxpayers. The suspect, who resides in Essonne, a southern suburb of Paris, has been placed in preventive detention following his arrest by the Office for Combating Cybercrime (OFAC).
The indictment, confirmed by the Paris prosecutor's office on August 20, charges the young man with unauthorized access to an automated personal data processing system as part of an organized group and fraudulent extraction of data from a state-operated system. The charges stem from attacks that occurred in June and July 2026, when hackers obtained the credentials of a Direction Générale des Finances Publiques (DGFiP) employee and an authorized third party.
The breach, publicly revealed on August 13, has evolved into a major political crisis for the government. David Amiel, minister for public action and accounts, who assumed office on February 22, 2026, issued a public apology and faced calls for resignation from opposition parties.
"What happened is unacceptable for the French people. We understand their anger and we share it,"Amiel stated. Prime Minister François Bayrou called an emergency crisis meeting to address the security failure.
Sophisticated Attack Method and Scope
The stolen data includes highly sensitive personal information: names, dates of birth, home addresses, telephone numbers, family circumstances, reference taxable income, and withholding tax rates for individuals. For businesses, the compromised data encompasses company names and SIREN identification numbers. Tax authorities characterized the incident as more sophisticated than any previous cyberattack they had encountered, with the advanced techniques preventing initial detection even after security measures were implemented.
A hacker group operating under the alias ZeroBytes claimed responsibility for the attack on dark-web forums on August 12 and 13. According to their posts, the group accessed tax authority systems through a compromised VPN and subsequently sold the stolen data to two buyers for thousands of euros. The same group also claims responsibility for a separate June 2026 attack that allegedly compromised approximately 200,000 accounts containing cadastral information related to property and land ownership.
Multi-Agency Investigation Underway
The investigation involves multiple French government agencies. OFAC, created in December 2023 to replace two previous investigative bodies, operates under the National Directorate of the Judicial Police with a staff of 180 specialized in technology-related crime. France's national cybersecurity agency ANSSI is conducting technical analysis of the breach, while the DGFiP has notified the data protection authority CNIL and filed a criminal complaint.
Authorities emphasized that usernames, passwords, and access to taxpayers' secure online accounts on impots.gouv.fr were not compromised. However, officials warned that the stolen personal details could enable highly convincing phishing attacks against affected individuals and businesses.
Part of Broader Cybersecurity Crisis
This attack represents the latest in a wave of major data breaches affecting French government agencies and public institutions between 2024 and 2026. Previous incidents include the France Travail employment database breach exposing 43 million records, Free telecommunications compromise affecting 19.2 million customers, the ANTS national secure document service breach impacting 11.7 million accounts, and unauthorized access to 1.2 million accounts in the FICOBA financial database.
The pattern of successful attacks on government systems has raised urgent questions about France's cybersecurity infrastructure and its ability to protect citizens' sensitive information. The indictment of the 18-year-old suspect marks a significant development in the investigation, though authorities continue to examine the full extent of the breach and identify any additional perpetrators involved in the organized attack.
