Teen who was 15 at the time charged over the French tax authority hack

He is 16 today, and he was 15 when the French tax authority was hacked. Arrested on Tuesday, October 27, by the Office anti-cybercriminalité (Ofac, France's national cybercrime office), a teenager nicknamed “Casquette” (Cap) was formally charged the next day in Paris, according to a report by Le Monde confirmed by the Paris prosecutor's office. He was placed under judicial supervision.

He is notably charged with fraudulent extraction of data from an automated personal data processing system operated by the State, as part of an organized group, and with fraudulently accessing and remaining in that system. According to franceinfo, these offenses carry a penalty of up to ten years in prison. His lawyer, Réda Ghilaci, points out that his client “is presumed innocent” and says he will contest the charges.

What happened at the tax authority this summer?

The intrusions took place in late June and late July 2026. The Paris prosecutor's office opened an investigation on July 31, after the first complaints and before any claim of responsibility. In mid-August, a group calling itself ZeroBytes, which presents itself as a duo, claimed the attack on the Direction générale des finances publiques (DGFiP, France's public finance directorate).

According to the DGFiP, data on more than 678,000 individuals and businesses was stolen, some of it sensitive. According to franceinfo, an incident report from ANSSI, France's national cybersecurity agency, describes an unsophisticated attack that took advantage of numerous blind spots in the detection of abnormal activity. ANSSI recently pointed out that most data thefts require no technical vulnerability at all.

Who are the other suspects?

“Casquette” is not the first. An 18-year-old man, also suspected of belonging to ZeroBytes, was charged on August 20 and placed in pretrial detention. Franceinfo identifies him by the alias “ChatNoir” (Black Cat) and says he is also being prosecuted in connection with the 2024 Free data breach. “Casquette” himself had previously been taken into police custody, then released.

According to franceinfo, both suspects are also being prosecuted for their alleged membership in another collective, “Epsilon,” accused of attacks on several French companies and of hacking the X accounts of BFMTV and RMC in 2024. According to AFP, the prosecutor's office also attributes other alleged victims to ZeroBytes: the Créteil school district, the Agence pour l'enseignement français à l'étranger (AEFE, the agency for French schools abroad), France Travail (the French employment agency), the French Handball Federation, Intermarché and SFR.

What to do if your data has leaked

Stolen tax data is first used to make fake messages “from the tax office” look credible. If in doubt, don't click: go through your account on impots.gouv.fr by typing the address yourself. Report suspicious text messages to 33700 and fraudulent websites to the Pharos platform.

The investigation continues. The role of each person in a group that claimed to have only two members has yet to be established.