{"schema_version":"0.10.0","id":"LR-2026-0775","record_version":1,"title":"FBI and French authorities seize deepfake CSAM-for-sale websites","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":45.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":2.24,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: CyberScoop · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: CyberScoop · subject to change"}]},"sources_hash":"438e5bcbd3541728454a68470d11d070a6766cf272788a82f5d6303e723504b5"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-07","incident_class":"other","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Two websites, NudeLeaksTeens and NLTVIDS, were used to disseminate child sexual exploitation material, including AI generated deepfake media. The sites posted disclaimers disavowing child pornography while advertising and selling such material, and some of it came from victims' social media accounts. Law enforcement first became aware of the websites in 2024. The FBI seized and shut down the sites this week, and the French Paris Prosecutor's Office arrested an unnamed 25-year-old French resident suspected of being the primary administrator. Several victims reported to law enforcement that their accounts were hacked. The sources describe no AI agent involved in the sites' operation.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":315,"severity":"major","severity_because":"Test: many third parties, a stated count of two or more affected parties. The source states 315 different girls in one collection.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://cyberscoop.com/fbi-french-authorities-seize-deepfake-csam-websites/","publisher":"CyberScoop","date":"2026-10-07","type":"press","title":"FBI, French authorities seize deepfake CSAM-for-sale websites - CyberScoop","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"impact.third_parties_affected_count":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"impact.third_parties_affected_count":[{"source_index":0,"quote":"One collection, containing 189GB of material on 315 different girls, sold for $64.90."}],"event.incident_class":[{"source_index":0,"quote":"The FBI and French authorities have arrested an individual and seized a pair of websites that were used to disseminate child sexual exploitation material, including AI generated deepfake media, according to court documents."}],"impact.severity":[{"source_index":0,"quote":"One collection, containing 189GB of material on 315 different girls, sold for $64.90."}],"impact.severity_because":[{"source_index":0,"quote":"One collection, containing 189GB of material on 315 different girls, sold for $64.90."}],"event.summary":[{"source_index":0,"quote":"The FBI and French authorities have arrested an individual and seized a pair of websites that were used to disseminate child sexual exploitation material, including AI generated deepfake media, according to court documents."},{"source_index":0,"quote":"The sites posted explicit disclaimers disavowing child pornography while simultaneously advertising and selling CSAM."},{"source_index":0,"quote":"Some of the material came from victims’ social media accounts on Snapchat, TikTok, Instagram and Facebook, either recorded directly or stolen from their accounts."},{"source_index":0,"quote":"law enforcement first became aware of the websites in 2024, which advertised hacked, leaked and stolen CSAM of young girls."},{"source_index":0,"quote":"The websites, NudeLeaksTeens and NLTVIDS, were seized and shut down by the FBI this week."},{"source_index":0,"quote":"Several victims who appear on the site reported to law enforcement that their accounts were hacked."}]},"notes_on_gaps":"Source 0 is a single press article; it describes websites that distributed CSAM, not an AI agent or AI system operated by any developer. System, agent, failure-class, control, and remediation fields are therefore omitted because no source states them. Judgements made: incident_class set to other (the sites are distributors, not a model output); risks RK15 and RK04 chosen from the stolen victim material; severity major because the source states 315 different girls in one collection, which meets the stated-count test; 315 is the count for one collection, not a stated total of affected parties. The $64.90 figure is a sale price, not a loss, so direct_loss_usd is omitted. The 2024 awareness date is year-only and no month or day was given, so date_detected is omitted. The date the incident occurred is not stated. The 2026-10-07 article date is not a disclosure date stated by a source, so date_disclosed is omitted. Country and industry are not stated as a single fact. Victim count and records exposed are not stated in total. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: CyberScoop · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"Some material was taken from victims' social media accounts, either recorded directly or stolen.","quote":"Some of the material came from victims’ social media accounts on Snapchat, TikTok, Instagram and Facebook, either recorded directly or stolen from their accounts.","source_index":0,"grade":"C"},{"step":"reached","text":"One collection held 189GB of material on 315 different girls and was sold for $64.90.","quote":"One collection, containing 189GB of material on 315 different girls, sold for $64.90.","source_index":0,"grade":"C"},{"step":"caught","text":"Law enforcement first became aware of the websites in 2024.","quote":"law enforcement first became aware of the websites in 2024, which advertised hacked, leaked and stolen CSAM of young girls.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://cyberscoop.com/fbi-french-authorities-seize-deepfake-csam-websites/"]},"analysis":{"sections":{"timeline":[{"text":"A collection named after Reuben Oswaldo Yeverino Rosales was for sale on one site; he was convicted and sentenced in 2022.","quote":"A separate collection available for sale on one of the sites in 2022 and 2023 was named after an individual, Reuben Oswaldo Yeverino Rosales, who was convicted and sentenced to more than 34 years in prison in 2022 for sexual exploitation of children and cyber stalking.","source_index":0,"when":"2022 and 2023"},{"text":"Law enforcement first became aware of the websites.","quote":"law enforcement first became aware of the websites in 2024, which advertised hacked, leaked and stolen CSAM of young girls.","source_index":0,"when":"2024"},{"text":"Andrew Venegas was sentenced to 30 years in prison after a guilty plea; some collections were compiled by individuals serving sentences.","quote":"One individual, Andrew Venegas, pled guilty in a Texas federal court to sexual exploitation of children and receipt of CSAM as was sentenced to 30 years in prison in April 2026.","source_index":0,"when":"April 2026"},{"text":"A seizure warrant was filed in the Eastern District of Virginia.","quote":"According to a seizure warrant filed Oct. 2 in the Eastern District of Virginia by Arlington County police detective and FBI cybercrime task force member John Bamford, law enforcement first became aware of the websites in 2024, which advertised hacked, leaked and stolen CSAM of young girls.","source_index":0,"when":"Oct. 2"},{"text":"The French Paris Prosecutor's Office arrested an unnamed 25-year-old French resident suspected of being the primary administrator.","quote":"According to the Department of Justice, the cybercrime division of the French Paris Prosecutor’s Office has also arrested an unnamed 25-year-old French resident suspected of being the primary administrator for the sites.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://cyberscoop.com/fbi-french-authorities-seize-deepfake-csam-websites/"]}}