Tax hacking: 16-year-old hacker indicted, his tools also threaten crypto holders

Sixteen years old, and already two indictments. Le Monde reports that the teenager nicknamed “Cap” was indicted on Wednesday October 28 in the investigation into the hacking of the DGFiP. Justice is now targeting a boy from Bouches-du-Rhône, suspected of having helped siphon off the data of 678,000 taxpayers.

For crypto holders, the matter goes well beyond the tax authorities. The duo targeted by the judges sold an infostealer that sucks passwords and wallets from infected computers. The files stolen from Bercy offer as a bonus the names, addresses and income of hundreds of thousands of French people.

The Anti-Cybercrime Office (OFAC) placed him in police custody on Tuesday October 27, following letters rogatory from the investigating judges. The next day, judges indicted him for fraudulent extraction of data from an organized state system. Added to this is fraudulent access and maintenance in this same system.

He was 15 years old at the time of the events. The Paris public prosecutor's office had requested a judicial review, and this is what the magistrates accepted. His lawyer, Réda Ghilaci, spoke to Le Monde of a “particularly fragile” indictment. He plans to contest it in the coming days.

Casquette is not unknown to the services. He had already been in police custody at the end of August at the cyber brigade of the Paris police headquarters. On September 4, he was indicted in another procedure targeting the Epsilon group. His alleged accomplice ChatNoir (18 years old) has been in pre-trial detention since the summer in the tax case.

Under the Epsilon banner, the tandem resold an infostealer to other cybercriminals. The judges also credit him with hacking Shadow and LDLC between 2023 and 2024. The principle is brutally simple. Once on the machine, the program copies the passwords memorized by the browser and transmits them to its operator.

It was through this door that Bercy fell. The Anssi report published on September 29 estimates that several dozen agent identifiers were “probably sucked up by infostealers”. The tax authorities did not administer these computers. Two portals did not have strong authentication, and around 14 GB of data went out in three months without triggering an alert.

The batch stolen from the DGFiP contains 392,867 individuals and 285,570 professionals, with reference tax income, address and family situation. For a robber looking for a wealthy home to visit, it’s a directory. Anssi specified at the end of September that no attack had yet been linked to these files. ZeroBytes, however, claims to have sold part of the data to two buyers for a few thousand euros.