This Monday, ZeroBytes, the hackers behind the theft of tax data, announced bad news: the sale of stolen data, unverifiable declarations at a moment when the government is holding a crisis meeting!!
According to this group, the files were sold to “two people” for an amount in the “thousands of euros.” He refuses to say more about the buyers.
“The data is still for sale,” he adds, the same dataset could be copied and sold to several clients.
ZeroBytes claims to be composed of two hackers presenting themselves as French. The AFP spoke with the group on Telegram, based on coordinates published on a dark web forum dedicated to the sale of stolen data.
Asked about their objectives, the duo says they have no “specific motivations,” other than “money, I suppose.”
The Directorate General for Public Finances (DGFiP) confirmed on August 14 two intrusions, occurring at the end of June and the end of July, as well as the theft of data concerning at least 678,000 individuals and professionals and about 200,000 accounts in its cadastral files.
Among the personal tax information stolen are the names and surnames, the fiscal reference income, the family quotient, or the withholding tax rate.
The precision of these files fuels fears of targeted scams. In the cybercrime economy, the hacker who breaks into a system is generally not the one who will then exploit the information: the stolen databases are often resold to fraud specialists.
Before targeting the tax authorities, ZeroBytes had already claimed on dark web forums hacks aimed at the Intermarché supermarkets and the French Handball Federation.
The group also claimed during the summer to have stolen data from a major French mobile operator and from a hotel group. These two attacks have not been confirmed by the companies concerned.
On the forums selling stolen data, French organizations regularly appear among the targets. They would be “easy to hack,” according to ZeroBytes to explain its interest in France.
The Paris prosecutor’s office has opened an investigation, notably for “fraudulent data extraction” and “criminal association.” Prime Minister Sébastien Lecornu has, for his part, convened an inter-ministerial crisis meeting.
The 678,000 affected users were to begin being contacted individually starting Monday to be warned about possible targeted scams.
