Is a 16-year-old boy behind the theft of data from 19 million Free customers ? A high school student indicted

Un garçon suspecté d'avoir réclamé 10 millions d'euros de rançon à Xavier Niel a été mis en examen à Paris (photo d'illustration). imageBROKER.com – Timon Schneider

Is a 16-year-old minor behind the theft of data from nearly 20 million subscribers of the operator Free ? On Wednesday, January 15, 2025, this boy suspected of having demanded 10 million euros in ransom from Xavier Niel was indicted in Paris.

A source close to the case indicated that this teenager arrested Monday in Essonne was indicted by a Parisian investigating judge and then placed in an educational center by a judge of liberties and detention.

In detail, the source specified that this high school student born in January 2008 was indicted for various offenses relating to an automated data processing system (fraudulent access and maintenance; fraudulent introduction of data; fraudulent possession of data; fraudulent extraction of data), but also for collection of personal data by fraudulent means or concealment of an attack on an automated data processing system.

He allegedly tried to extort Xavier Niel

The minor is also accused of an attempted extortion against Xavier Niel, founder of Free: he is suspected of having asked him for 10 million euros in cryptocurrencies in a message considered to be a ransom demand, in exchange for the return of the file, which the billionaire has refused.

In mid-November, the courts ordered the Telegram messaging service to reveal the identity of the hacker who had used the platform to put pressure on the chairman of the Iliad group.

200% Deposit Bonus up to €3,000 180% First Deposit Bonus up to $20,000

On October 21, the Free database, covering 19.2 million French customers, the majority of the company's 22.8 million subscribers, “including 5.11 million with an IBAN number, was put up for auction by a hacker on a cybercriminal forum”, recalled the public prosecutor, who had entrusted the investigation to the Cybercrime Brigade (BL2C) of the police headquarters.

The file contained personal data, such as their address, telephone number or email.

“Security vulnerability”

According to the source close to the case, the accused is suspected of having entered Free's servers via security breaches of an employee of the company.

The data file was resold for 20,000 euros and the minor pocketed half of the sum, according to another source close to the case.

The Paris prosecutor's office had indicated earlier in the day that this minor “identified as the author of this leak was already under judicial supervision, for having been arrested in June in a case of leaks of customer data, notably from Sport 2000, and hacking of the Twitter accounts (now X, Editor's note) of the Altice group (RMC, BFMTV)”.

According to the source close to the case, he had also been taken into custody in December but without being prosecuted, for other data leaks concerning other companies.

The defendant's lawyer, Camille Lucotte, said she was “very surprised that he was the only one being questioned in this case, when he is clearly a secondary actor and the main perpetrator has been clearly identified by investigators.”

“Willingness to cooperate”

“My client is willing to cooperate with the justice system”, she added, criticizing the prosecution which “fragmented the procedures, multiplied the searches and successive police custody for facts related”.

“They trusted us by filing a complaint and they understood everything! Thank you Free”, for her part, praised on LinkedIn, in a reference to the company's slogan, the deputy prosecutor Johanna Brousse, head of the cybercrime section.

“More than ever, we need to strengthen prevention for young people in cyber matters”, she added.

Between September and the end of November, in addition to Free, Auchan, SFR, the streaming platform Molotov, Truffaut, Cultura, Boulanger and Le Point all confirmed the data leak personal data of their users.

That is, several tens of millions of people concerned, customers or users, whose email addresses, postal addresses, and sometimes IBANs, are resold online by pirates.