Arrest of Suspected Serial Hacker Shakes French Cybersecurity Landscape
French authorities have taken a 20-year-old hacker into custody on suspicion of carrying out dozens of cyberattacks against public institutions, sports federations, and private-sector organizations throughout France, prosecutors announced on Wednesday. The suspect, who operated under the online alias HexDex, was detained on Monday in western France and placed in police custody under an investigation led by the cybercrime division of the Paris prosecutor's office.
According to local media citing authorities, the individual is believed to be connected to approximately 100 reports of website breaches filed since late 2025. The suspect reportedly admitted to using the HexDex alias both to claim credit for the intrusions and to distribute stolen data on underground cybercrime platforms, specifically BreachForum and Darkforum.
Evidence Seized, Forensic Analysis Underway
As part of the operation, investigators seized the suspect's Darkforum account along with computer hardware, all of which will be subjected to forensic examination. The breadth of the alleged targets suggests a prolific and indiscriminate campaign rather than a focused, targeted operation.
Wide Range of Alleged Victims
French officials stated that HexDex allegedly attacked a remarkably diverse set of organizations. Among the alleged victims were numerous national sports federations, including those governing:
- Sailing
- Athletics
- Motorsports
- Gymnastics
- Skiing
- Rugby league
- Aikido
- University sports
- Mountaineering and climbing
- Para-sports
Beyond the sports world, the suspect is also alleged to have targeted food banks, hotel chains Logis Hôtels France and Brit Hotel, and the renowned Philharmonie de Paris concert hall.
Breach of the Ministry of Education's HR Database
One of the most significant alleged intrusions linked to the suspect involves the French Ministry of National Education's "Compas" database, a human resources platform used to manage trainee teachers in primary and secondary schools. A cyberattack on this system in mid-March exposed the personal information of approximately 243,000 employees, the majority of whom were teachers.
The compromised data reportedly included names, home addresses, phone numbers, and absence records — a trove of sensitive personal information affecting a large portion of France's educational workforce.
Government Weapons Registry Also Allegedly Compromised
French media reports indicate that investigators believe HexDex also breached a government weapons information system containing records of registered firearm owners. If confirmed, this would represent one of the more sensitive alleged intrusions attributed to the suspect, given the security implications of exposing firearm ownership data.
Broader Wave of Cybercrime Investigations in France
The arrest comes against a backdrop of heightened cybercrime activity in France and active law enforcement responses. In January, police arrested an 18-year-old suspected of leaking and reselling personal data belonging to more than one million members of the French Shooting Federation (FFT).
Separately, French officials disclosed earlier this week that a cyberattack targeting the website of the National Agency for Secure Documents (ANTS) — the government portal responsible for managing national identity documents and driver's licenses — may have exposed users' personal data. Authorities have not publicly indicated whether the suspect arrested this week has any connection to that particular incident.
Investigation Continues
The case remains under active investigation. Prosecutors have not yet confirmed whether all approximately 100 breach reports will be formally attributed to HexDex, pending the forensic analysis of the seized equipment. The arrest nonetheless signals a significant step by French law enforcement in tackling a wave of domestic cybercrime that has struck institutions ranging from grassroots sports bodies to central government infrastructure.
The cybercrime unit of the Paris prosecutor's office is leading the ongoing inquiry, and further developments are expected as digital forensics work progresses.
Source: The Record