French Hacker Arrested for Mass Data Theft Targeting Government, Sports, and Private Sector
French authorities have arrested a 20-year-old man, known online as HexDex, suspected of exfiltrating data from dozens of organizations and leaking sensitive information. The arrest took place on 20 April 2026 at his home in Vendée, just as he was preparing to release additional stolen data.
The investigation began in late December 2025 after nearly 100 reports of data breaches were filed with the Paris prosecutor’s office. HexDex is accused of targeting a wide range of victims, including sports federations, government agencies, and private companies, and posting stolen data on platforms like Breachforums and Darkforums.
Targets of the Attack
HexDex allegedly compromised 15 French sports federations, spanning disciplines such as American football, rugby, skiing, boxing, and para-sports. Among the most severe breaches was an attack on the French Ministry of Education in mid-March 2026, where he accessed the Compas trainee teacher management system, exposing 243,000 employees’ personal details, including names, addresses, phone numbers, and absence records.
Other high-profile targets included:
- SIA (national firearm owner database)
- E-campus (police training platform)
- Moselle prefecture
- ANCT (National Agency for Territorial Cohesion)
- Choisir le service public (public service recruitment portal)
- Philharmonie de Paris (concert hall)
- Charities (food banks) and hotel chains (Logis Hôtels France, Brit Hotel)
Investigation & Ongoing Probes
The Cybercrime Brigade (BL2C) seized HexDex’s devices and took control of his Darkforums account, which now displays a seizure notice. While he has admitted to using the HexDex alias, authorities state he is not linked to a separate 15 April 2026 cyberattack on the ANTS portal, which may have exposed 12 million account holders’ data. HexDex remains in custody as forensic analysis continues to determine the full extent of the breaches.
Source: https://hackread.com/french-police-arrest-hexdex-hacker-data-leak-leaks/
FFF - Fédération Française de Football cybersecurity rating report: https://www.rankiteo.com/company/federation-francaise-de-football
Cyber-Defence Campus cybersecurity rating report: https://www.rankiteo.com/company/cyber-defence-campus
"id": "FEDCYB1777035448",
"linkid": "federation-francaise-de-football, cyber-defence-campus",
"type": "Breach",
"date": "4/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '243,000 employees',
'industry': 'Education',
'location': 'France',
'name': 'French Ministry of Education',
'type': 'Government Agency'},
{'industry': 'Sports',
'location': 'France',
'name': '15 French sports federations',
'type': 'Sports Organizations'},
{'industry': 'Public Safety',
'location': 'France',
'name': 'SIA (national firearm owner database)',
'type': 'Government Database'},
{'industry': 'Law Enforcement',
'location': 'France',
'name': 'E-campus (police training platform)',
'type': 'Government Platform'},
{'industry': 'Public Administration',
'location': 'France',
'name': 'Moselle prefecture',
'type': 'Government Agency'},
{'industry': 'Public Administration',
'location': 'France',
'name': 'ANCT (National Agency for Territorial '
'Cohesion)',
'type': 'Government Agency'},
{'industry': 'Public Administration',
'location': 'France',
'name': 'Choisir le service public (public service '
'recruitment portal)',
'type': 'Government Portal'},
{'industry': 'Arts & Entertainment',
'location': 'France',
'name': 'Philharmonie de Paris',
'type': 'Cultural Institution'},
{'industry': 'Charity',
'location': 'France',
'name': 'Charities (food banks)',
'type': 'Non-Profit'},
{'industry': 'Hospitality',
'location': 'France',
'name': 'Logis Hôtels France',
'type': 'Private Company'},
{'industry': 'Hospitality',
'location': 'France',
'name': 'Brit Hotel',
'type': 'Private Company'}],
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': '243,000 (Ministry of Education) '
'+ additional records from other '
'entities',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personal details (names, '
'addresses, phone numbers)',
'Absence records',
'Firearm owner data',
'Police training data',
'Public service recruitment data',
'Charity/hotel customer data']},
'date_detected': '2025-12-01',
'date_publicly_disclosed': '2026-04-20',
'description': 'French authorities arrested a 20-year-old hacker known as '
'*HexDex* for exfiltrating data from dozens of organizations, '
'including sports federations, government agencies, and '
'private companies. The hacker leaked sensitive information on '
'platforms like Breachforums and Darkforums.',
'impact': {'brand_reputation_impact': 'High',
'data_compromised': 'Personal details, names, addresses, phone '
'numbers, absence records, firearm owner data, '
'police training data, public service '
'recruitment data, and charity/hotel customer '
'data',
'identity_theft_risk': 'High',
'systems_affected': ['Compas trainee teacher management system',
'SIA (national firearm owner database)',
'E-campus (police training platform)',
'Moselle prefecture systems',
'ANCT (National Agency for Territorial '
'Cohesion)',
'Choisir le service public (public service '
'recruitment portal)',
'Philharmonie de Paris systems',
'Logis Hôtels France and Brit Hotel systems']},
'investigation_status': 'Ongoing (forensic analysis in progress)',
'motivation': 'Data exfiltration and public disclosure',
'references': [{'date_accessed': '2026-04-20',
'source': 'French authorities and cybersecurity reports'}],
'regulatory_compliance': {'legal_actions': 'Arrest and ongoing investigation'},
'response': {'containment_measures': 'Arrest of HexDex, seizure of devices, '
'takeover of Darkforums account',
'law_enforcement_notified': 'Yes (Paris prosecutor’s office, '
'Cybercrime Brigade - BL2C)'},
'threat_actor': 'HexDex (20-year-old French hacker)',
'title': 'French Hacker Arrested for Mass Data Theft Targeting Government, '
'Sports, and Private Sector',
'type': 'Data Breach'}