Paris prosecutor charges second suspect in tax administration cyberattack case
Published · Updated
What happened
The Paris prosecutor formally charged a second suspect on 2026-09-04 in an investigation into cyberattacks connected to "ZeroBytes" that affected DGFiP and other public bodies. This followed the indictment of an 18-year-old suspect on 2026-08-20 in the same case.
Why it matters
A second charge within two weeks shows that the case is active and widening through a named judicial mechanism rather than closing around a single individual. That keeps pressure on the state’s digital resilience, law-enforcement follow-through, and the government’s handling of public-sector cyber defense.
The Paris prosecutor’s investigation into cyberattacks linked to the group known as "ZeroBytes" added a second suspect when a new defendant was formally charged on 2026-09-04. Coming after the indictment of an 18-year-old suspect on 2026-08-20, the case now points to a continuing judicial track rather than a one-off incident affecting DGFiP and other public bodies. The near-term path to a wider political issue runs through further arrests, prosecutorial disclosures, and opposition efforts to tie the attacks to ministerial responsibility for state cyber preparedness.
Watch for
Parquet de Paris filing or communiqué by 2026-09-14 naming additional suspects, counts, or affected public entities in the ZeroBytes case DGFiP public notice by 2026-09-14 on service disruption, remediation steps, or confirmed data exposure tied to the attack Assemblée nationale opposition group request by 2026-09-14 for a hearing of the Interior Minister or Digital Affairs minister on public-sector cyber defenses ANSSI statement or technical bulletin by 2026-09-14 attributing methods, indicators of compromise, or sector-wide defensive measures linked to the incident