French police have arrested three 17-year-old boys suspected of operating websites allegedly used to sell stolen personal information, following an investigation by the country’s anti-cybercrime unit.
Paris prosecutor Laure Beccuau announced the arrests on Friday, October 9, 2026, confirming that authorities had shut down two websites suspected of facilitating the sale and distribution of stolen data.
According to the prosecutor’s statement, one of the platforms, initially called Reacher, was launched in March and offered users access to personal information obtained from different sources through various subscription plans.
The service was renamed Stryx in June, as it continued to provide access to data allegedly collected from multiple sources.
Investigators said the platform claimed to store approximately 730 million lines of data, including names, residential addresses and bank account numbers.
The service had reportedly received about 3.1 million requests, although the available information does not clarify whether these represented unique users, individual searches or other types of activity.
The reported scale of the database has raised concerns about the potential exposure of personal and financial information and the risks such information could pose to individuals whose details may have been compromised.
Stolen personal data can potentially be exploited for identity theft, financial fraud, phishing and other forms of cybercrime. However, the prosecutor’s statement, as reported by Reuters, did not establish how much of the data was verified, how many individuals were affected or whether any specific financial losses had occurred.
The three suspects, all male and aged 17, could face prison sentences of up to 10 years if convicted, according to the report.
Their arrests followed action by France’s anti-cybercrime unit, which closed the two websites as part of the investigation.
The allegations against the teenagers have not been established in court. Their arrest does not amount to a finding of guilt, and further legal proceedings will determine the outcome of the case.
Authorities have not provided further details in the reported statement about how the suspects allegedly obtained the data, whether they acted alone or whether additional individuals are being investigated.
The case draws attention to the risks posed by online platforms that allegedly commercialise stolen personal information through subscription-based services.
When names, addresses and financial details are exposed, affected individuals may face increased risks of scams, impersonation and unauthorised attempts to access their accounts. The scale of the alleged Stryx database, if substantiated, could make the investigation significant for understanding how stolen data is collected and distributed online.
French authorities have shut down the two suspected websites, but the investigation remains subject to the legal process. Further details about the origin of the data, the number of people affected and the alleged activities of the suspects may emerge as the case progresses.
