“Zero Vacant Housing” taken offline after a massive leak claim

The government's digital service "Zero Vacant Housing" was inaccessible on Sunday, a few hours after the hacker group ZeroBytes claimed responsibility for a massive data leak. When contacted by AFP, the Ministry of Housing and Urban Development declined to comment at this stage.

The incident was revealed by French Breaches, a website specializing in monitoring cyberattacks in France. According to information published by the site, ZeroBytes claims to have accessed the platform's infrastructure and extracted 148.929.194 raw records.

This claim has not yet been confirmed by independent analysis or by government agencies. The exact nature of the alleged intrusion, the actual volume of data copied, and the number of people affected therefore remain to be determined.

A tool intended for local authorities and government services

Contrary to what its name might suggest, "Zero Vacant Housing" is not a platform offering housing to individuals. It is a public tool enabling local authorities and government services to identify long-term vacant properties.

The system should in particular facilitate contact with owners in order to understand the causes of vacancy and to promote the return of properties to the market.

To fulfill this mission, the platform processes information relating to housing, its owners, and the steps taken by local authorities. The sensitivity of this data explains the concern raised by ZeroBytes' claim.

149 million lines do not mean 149 million victims

The figure put forward by the hackers should be interpreted with caution. It would correspond to a set of raw, non-deduplicated lines, and not to 149 million accounts or distinct individuals.

The same person may appear several times in the databases, particularly when they own several properties or when their information appears in different administrative files.

According to French Breaches, the claimed data includes approximately 82 million records linked to property owners and nearly 67 million lines from a file associated with the French tax authorities (DGFiP) and the French land registry (DataFoncier). Several thousand user accounts for the platform are also said to be present in the files.

ZeroBytes provides several estimates of the number of unique individuals, but the deduplication methods used produce very different results. Therefore, these figures do not allow for a reliable determination of the number of potential victims.

Personal and real estate data potentially exposed

According to the claim, the files could contain names and surnames, dates of birth, postal addresses, and identifiers associated with property owners and real estate. Email and telephone contact information would also appear in some tables.

The hackers also claim to have obtained information linked to approximately 3.500 user accounts of "Zero Vacant Housing," including cryptographic hashes of passwords. A cryptographic hash is not a directly readable password, but its exposure can still pose a risk, particularly if the same password is reused across multiple services.

Technical information relating to the operation of the platform may also have been compromised. Its content, current validity, and possible deactivation have not been confirmed.

A possible new intrusion at the DGFiP has not been proven.

ZeroBytes had previously claimed unauthorized access to the information system of the French Public Finances Directorate (DGFiP). The DGFiP has since confirmed the consultation and extraction of data concerning 678.000 individuals and professionals following intrusions that occurred in June, July, and August 2026.

It is important, however, to distinguish between the two cases. The alleged presence of data from the French Public Finances Directorate (DGFiP) in the "Zero Vacant Housing" databases does not prove that hackers have again directly penetrated the tax administration's systems. A public service may legally use files from other government agencies to carry out its duties.

Only technical investigations will be able to determine if the two incidents are linked and precisely identify the path taken to access the claimed data.

An increased risk of attempted scams

If the leak is confirmed, the main risk for the owners and users of the platform would be the emergence of particularly credible phishing attempts or fraudulent calls.

The combination of personal and property information could allow fraudsters to impersonate an administration, a community, a real estate professional or a housing agency.

While awaiting official communication, individuals receiving unusual messages regarding their housing or tax situation should avoid sharing usernames, passwords, bank details, or identity documents. It is also recommended to access government websites directly, without using links contained in unsolicited emails or text messages.

Investigations are expected to assess the incident.

Several questions remain unanswered: Does the claim correspond to a complete or partial extraction of the databases? How many owners and users are actually affected? Is the data recent? Have technical access methods been disabled?

In the event of a proven violation, the responsible body must assess the consequences, make the necessary regulatory notifications and inform the persons concerned when the level of risk requires it.

The communication from the Ministry of Housing will therefore be crucial in confirming or refuting ZeroBytes' claims and specifying the measures taken to secure the platform.