On April 22, 2026, investigators from the Paris prosecutor’s cybercrime unit arrested a 20-year-old in western France on suspicion of conducting approximately one hundred data breaches since late 2025. The suspect, known online as HexDex, is accused of operating across BreachForum and Darkforum — two of the primary marketplaces for stolen data on the dark web — selling records from victims that ranged from hotel chains to organs of the French state.
Among the most significant alleged intrusions: the French Ministry of National Education’s employee database, containing records on approximately 243,000 government workers, and a government information system managing firearm registration data — a database of who in France owns a weapon.
The Scope: One Hundred Incidents in Six Months
According to French authorities, HexDex filed approximately one hundred breach reports under his alias across dark web forums since late 2025 — a pace of roughly four breaches per week. That volume, sustained over months, puts him in a category of actors known less for the technical sophistication of individual intrusions than for relentless, industrialised targeting.
The alleged victim list is unusually broad. Cultural institutions appear alongside government ministries. Commercial hotel chains sit next to national sports governing bodies. The common thread is not industry or sector but opportunity: organisations with data that has value on dark web markets and security configurations that left them reachable.
Identified victims include at least a dozen national sports federations — the kind of bodies that hold athlete and staff personal data, financial information, and event logistics. The Philharmonie de Paris, one of France’s premier concert halls, appears in the reported victim list. Hotel groups Logis Hôtels and Brit Hotel — both with thousands of customer records and payment data — were also among the targets.
The Government Data Problem
The Ministry of National Education breach is the most sensitive of the reported incidents. A database containing records for approximately 243,000 employees across the French public school system represents a comprehensive cross-section of government worker personal data: names, job titles, contact information, and in many cases payroll and administrative records. That dataset has lasting value for phishing campaigns, identity fraud, and credential stuffing long after the initial sale.
The weapons registry intrusion carries a different risk profile. A database tracking firearm ownership in France is sensitive not merely because of the personal data of gun owners — though that alone is significant — but because the information could be used to identify targets for physical theft, to infer security arrangements at private residences, or to enable targeted harassment of individuals who have legally registered weapons.
French authorities have not publicly confirmed the technical method used to access either system. Whether the intrusions exploited known vulnerabilities, used credential-stuffing from previously breached datasets, or relied on some other entry vector has not been disclosed.
BreachForum and Darkforum: The Sales Channel
HexDex allegedly used two platforms to monetise his intrusions. BreachForum — which has cycled through multiple iterations following law enforcement actions, most recently the FBI’s seizure and the subsequent relaunch under new administration — remains one of the primary venues for selling stolen data. Darkforum, which operates in a similar space, provided a secondary channel.
The pattern is consistent with how financially motivated hackers operated through 2024 and 2025: breach an organisation, extract a dataset, post samples on forums to establish authenticity, list for sale. Buyers range from other cybercriminals building phishing lists to brokers who aggregate datasets for resale.
Whether HexDex had buyers for all one hundred claimed breaches, or whether some listings went unsold, has not been confirmed. What French investigators had, however, was enough to identify him and make the arrest — suggesting either forum operational security failures, digital trail analysis, or information from platform cooperation.
Age and the Profile of the Modern Cybercriminal
HexDex is twenty years old. That age is not unusual in this context. The cybercrime forums he allegedly frequented have long been populated by teenagers and young adults — English-speaking groups like Scattered Spider built their entire criminal enterprise on members who were, in several cases, under eighteen when they began operating. The barrier to entry for this type of activity has dropped sharply: tutorials exist, tools are available for purchase, and dark web forums provide both the technical community and the sales infrastructure.
What is less common is conducting one hundred breaches before the age of twenty-one. That volume suggests either a significant personal technical capability, access to purchased tools that automated portions of the attack chain, or both. French authorities have not released details of the methods used.
The arrest took place in western France. The investigation was led by the Paris prosecutor’s cybercrime division, which handles France’s most significant cyber cases — the same unit responsible for earlier prosecutions of actors targeting French financial and health sector institutions.
What Happens Next
HexDex has not yet been formally charged at the time of writing, though the arrest itself indicates French prosecutors believe they have sufficient evidence to proceed. The potential charges under French law for computer fraud, unauthorised access to data processing systems, and the resale of stolen personal data carry substantial custodial exposure.
For the affected organisations, particularly the Ministry of National Education and the firearms registry administrator, the breach creates notification obligations under GDPR. French data subjects whose information was in the exposed datasets should be informed if the compromised data creates meaningful risk — and a government employee database sold on dark web markets plausibly meets that threshold.
The affected sports federations, hotels, and cultural institutions face their own notification assessments. None had published breach disclosures as of the time of writing.
The Broader French Cyber Context
France has seen a notable pattern of intrusions targeting public sector databases over the past eighteen months. The healthcare sector in particular was hammered in 2024 and 2025, with multiple hospital groups and health insurance databases breached in incidents affecting tens of millions of patients. The HexDex case extends that pattern beyond healthcare into education, government registry infrastructure, and civil society organisations.
French cybercrime law enforcement has responded with increased prosecution activity. The Paris cybercrime unit has built a track record of identifying domestic actors operating on international dark web platforms — using forum registration patterns, cryptocurrency transaction analysis, and in some cases cooperation from platform operators to identify suspects whose online operational security was weaker than their technical skills.
Twenty years old, one hundred claimed breaches in six months, and an arrest before a single victim had publicly disclosed the intrusion. The velocity of this activity — and the fact that it took months to surface — says as much about the detection gap as it does about the individual who exploited it.
HexDex was arrested on April 22, 2026 by the Paris prosecutor’s cybercrime unit. He is suspected of approximately 100 data breaches since late 2025, including the French Ministry of National Education employee database and a government firearms registry. He is alleged to have sold stolen data on BreachForum and Darkforum. French charges have not been formally filed at the time of writing.
