In January 2025, a hacker known as ChatNoir was investigated for hacking the internet service provider Free, which affected over 19 million customers. A judge ordered him to be placed in a closed educational center, but he later received judicial supervision and was released. This summer, he was arrested by the Anti-Cybercrime Office (OFAC) for stealing data from the French tax authority, DGFiP. On August 20, he was formally investigated for "fraudulent access and maintenance" as part of an organized group. ChatNoir, who lives in Essonne, was placed in provisional detention after two cyberattacks in June and July 2026. These attacks used compromised credentials from state agents to extract data from 678,000 individuals and professionals, including their tax income information. A third breach targeted a government portal for vacant inheritances. The group behind these attacks, called ZeroBytes, claimed responsibility for the leaks. Bercy, France’s finance ministry, confirmed the hacking, and nearly 700,000 people may be affected. The situation escalated into a government crisis, with the Minister of Public Action and Public Accounts, David Amiel, apologizing for the breach. Opposition leaders demanded his resignation, and Prime Minister Sébastien Lecornu formed a crisis cell to address the issue. When questioned by BFMTV, the hackers from ZeroBytes justified their actions by pointing out the poor security of their targets. ChatNoir already had a criminal record by the age of 18. Before targeting the tax authority, he was linked to the hacking group Epsilon, which was active in 2023 and 2024. Epsilon was responsible for hacking a hosting provider, a tech retailer, and media outlets. Adding to his record, he hacked Free and the DGFiP, making his hacking career span at least three years, starting in his teenage years. The evidence against him was clear. In January 2024, after hacking a gaming forum, the attackers left a clear signature: “PIRATE (…) CHATNOIR CASQUETTE.” ChatNoir Casquette, born in 2010, was placed under investigation in September 2024 for the Epsilon case and placed under judicial supervision. At the time of the incident, he was only 13 years old. This profile of a young, socially isolated hacker seeking notoriety is a growing concern for investigators. According to a police report cited by franceinfo, the hackers responsible for these data leaks are typically young men, often minors, averaging 17 years old. They tend to target high-profile public institutions to gain attention. The tax authority is not the only victim; ZeroBytes has also attacked public education bodies, employment agencies, and private companies. Despite ChatNoir’s arrest in August 2026, the ZeroBytes account continued to leak stolen data until September 2, before suddenly disappearing. Other members of the group are still at large. New leaks continue to emerge, and a Senate report has highlighted "structural weaknesses" in Bercy’s cybersecurity infrastructure. On the victims' side, hundreds of taxpayers are already suing the state in court. For those affected, the main concern is not legal consequences but the real risk of identity theft and scams. Theft of personal data can lead to fraudulent withdrawals from bank accounts. If you received an alert email from the DGFiP, it is important to take steps to block fraudulent SEPA withdrawals and minimize the damage.