A 22-year-old man from Limoges, previously convicted for similar acts, has been arrested in connection with last week's cyberattack on the Interior Ministry's servers, which compromised confidential records from the TAJ and FPR databases. Interior Minister Laurent Nuñez called the breach 'very grave' and ordered security upgrades including two-factor authentication.
Following the cyberattack confirmed last Friday on Interior Ministry servers—initially reported as targeting email systems and internal applications—a 22-year-old suspect born in 2003 was arrested on December 17 in Limoges by the Research and Intervention Brigade (BRI). Living with his mother, he faces charges of 'damage to an automated personal data processing system implemented by the State in an organized gang,' punishable by up to 10 years in prison. He was previously convicted in 2025 for similar offenses.
The breach allowed extraction of dozens of confidential records from the TAJ (Judicial Antecedents Processing) database, which includes convictions and investigation data with victims' and witnesses' details, and the FPR (Wanted Persons File), listing fugitives, bans, and disappearances. A hacker group claimed responsibility on a forum, alleging access to data on over 16 million people, though without proof.
Minister Laurent Nuñez attributed the intrusion to agents exchanging access codes in plain text via professional emails, despite training: 'There are 300,000 agents... an individual or group could retrieve [codes].' He described the incident as 'very grave' in the National Assembly and mandated systematic two-factor authentication.
The Paris prosecutor's cybercrime unit leads the investigation, handled by the Anti-Cybercrime Office, with custody up to 48 hours. Judicial, administrative inquiries continue, and the CNIL has been notified.
