Six months to two years' imprisonment were handed down on Tuesday by the Paris court against, in its words, a "gang of young people" who had "flooded the French territory" with false vaccination certificates against Covid-19.
It is “the affair of a gang” of “geeks” who monetized what “should not have been”, in the middle of a global pandemic, and who “took advantage of the technical flaws of the system”, through “bait gain”, to make “villainous profits”, summarized the president of the court.
Also read: Tracking down fake health passes, a mission impossible?
If similar cases exist, this one “was distinguished by the number of health professionals impacted”, more than thirty, “by the number of false passes generated, more than 121,000, as well as by “the profits estimated” at 22 million euros, added the president.
Thirteen defendants aged 21 to 34 appeared in November, prosecuted in particular for money laundering in an organized gang for the production and resale of false passes between July 2021 and January 2022, mainly in the Paris and Lyon regions.
On Tuesday, up to two years of imprisonment were handed down, sentences accompanied by adjustments for the majority, as well as fines ranging from 8,000 euros to 50,000 euros.
The case came to light after the complaint, in September 2021, of a general practitioner from Charente-Maritime who denounced the fraudulent use of his E-CPS account, the application which allows health professionals to authenticate and access the digital services of the digital health agency.
From 200 to 400 euros for a fake health pass
The doctor had been contacted by a nurse, herself alerted by the information appearing on the pass of a firefighter, who had to admit having obtained a fake in exchange for 400 euros.
Vaccination was then compulsory in France for caregivers and nursing home employees and the pass for people who wanted to access restaurants, interregional trains, department stores or other places open to the public.
The doctors' order had also filed a complaint for the hacking of 35 practitioners' accounts.
Originally, the traffic began on a small scale with the purchase of a botnet on the Genesium Market platform - known for the resale of identification information and cookies - and the modification of around ten accounts and the issuance of passes sold to Russians for 200 to 250 euros.
Once the accounts were modified, it was possible to activate E-CPS, the electronic identification method, on a customer's phone so that the latter would generate false passes.
Access rental was billed at 2000 to 3000 euros per week.
In December 2021, another complaint was filed, by a nurse.
More than 54,000 passes had been issued under his identifier, even though he had not vaccinated anyone.
By sampling, it was established during the investigation that in a period of four hours, the maximum duration of a connection to a session without authorization, an average of 300 passes could be generated.
In this vast network, passes were bought and resold on social networks, including Snapchat or Telegram.