-
A hacking group called ZeroBytes claims it broke into Zero Vacant Housing, a French government housing platform.
-
The gang says it took records tied to almost 48 million property owners across the country.
-
This marks the group’s third claimed attack on French state systems this year, after earlier hits on tax and education data.
The Zero Vacant Housing website stayed down all weekend. Visitors saw an error message saying the page does not exist. The Ministry of Cities and Housing runs this public tool. It helps local governments find empty homes and get them back on the market.
The outage began right after a hacking group known as ZeroBytes claimed it hit the platform. This group has a busy track record this summer. It already claims credit for three leaks tied to French tax data, exposing 700,000 taxpayers.
ZeroBytes also claims it hacked into the National Education system, allegedly pulling out two decades’ worth of records. According to Cyberattaque.org, the group did not slow down this time either.
What the Hackers Say They Took
The hackers claim they stole a national property file called DataFoncier 2024, straight from the servers of Zero Vacant Housing. This file lists land and property details across France. MacGeneration reports that ZeroBytes says it pulled almost 149 million raw lines of data from the platform.
That number alone does not mean 149 million separate people got hit. Records often repeat across different tables. Once the hackers removed duplicates, they say close to 48 million individual people remain in the stolen files, according to Cyberattaque.org.
On a criminal forum, the group also claims it grabbed login details for 3,538 accounts. These accounts mostly belong to local government staff who use the housing platform daily. Some of the stolen data reportedly includes records tied to state agents and outside contractors too, not just property owners.
The hackers say they first slipped in through a hidden page. That page connected to Metabase, a tool the platform uses to study its own data. From there, they claim they used a working administrator login to pull out the records without anyone noticing at first.
Samples reviewed by Cyberattaque.org reportedly show full names, birth dates, home addresses, and property-related ID numbers. Some samples also allegedly carry email addresses and phone numbers, France Info reports. Out of 500 sample rows checked, most included a phone number, and many carried an email address too.
That kind of mix is valuable to scammers. Criminals could use it to send fake tax emails or calls. Property tax bills are due in the coming weeks, which gives crooks a timely excuse to trick people. A caller who already knows your name, address, and property details can sound very convincing.
Government Response Still Unclear
Prime Minister Sébastien Lecornu spoke out on Saturday, August 29, 2026. He admitted French government systems have weak spots. However, he did not directly confirm this specific breach. State officials have not confirmed the attack either. No outside expert has verified the leaked samples yet.
The ZeroBytes attack follows a separate unverified claim against Location-Etudiant.fr, a French student housing portal. A hacker claimed to have stolen a 10 GB MySQL database from the platform, allegedly containing usernames, emails, phone numbers, addresses, IP addresses, and encrypted passwords.
Lecornu used a home security comparison to describe the wider problem. He said the country had a house locked tight behind an armored door, but the key still ended up under the doormat. He added that word about the hidden key had spread through the whole neighborhood. His comment suggests real data may already be at risk, even without a formal confirmation.
One member of ZeroBytes told reporters the group still has more data in reserve. The hacker also pushed back on claims that France has weak cyber defenses overall, according to reports.
France Sets Up a Counterattack Plan
French officials are now building a bigger response as ZeroBytes keeps up its attacks. Lecornu set up a special crisis team across different ministries. He also brought in ANSSI, the national cybersecurity agency, which plans to share its findings next month.
David Amiel, the minister for public accounts, unveiled a fresh plan to boost data security across government systems. The plan includes a bug bounty program. This pays outside researchers who find and report security flaws before criminals do.
The plan also calls for new state-run AI tools built to check government computer systems for weak points. Under President Emmanuel Macron, France also wants clear answers about an earlier attack on the country’s main tax authority, the Directorate General of Public Finances.
To dig into these repeated breaches, officials plan to hold a special Defense Council meeting focused only on hacking threats. That meeting is expected within the next few weeks, as pressure builds on the government to show it can protect citizens’ data.
For now, property owners cannot confirm whether their own information sits inside the leaked files. Experts recommend watching emails and calls closely, especially any messages tied to property tax payments.
Anyone who spots a suspicious message should contact the tax office directly, not reply through the message itself. Staying alert now is the safest move until officials confirm the full scope of this leak.
