On April 15, 2026, the Agence nationale des titres sécurisés (ANTS), the French state agency that processes applications for passports, national identity cards, driving licences, residence permits and vehicle registration documents, detected a security incident on its ants.gouv.fr portal. The Paris prosecutor's cybercrime section was seized the following day. The Interior Ministry published a press release on April 20 confirming an incident potentially involving disclosure of data from personal and professional accounts, and on April 21 put the number of affected accounts at 11.7 million.
A 15-year-old was placed in custody on April 25, a judicial investigation was opened on April 29, and the Paris prosecutor announced the case publicly on April 30.
Two numbers are in circulation and they are not equivalent. 11.7 million is the figure stated by the Interior Ministry. 19 million is the figure asserted by an actor using the handle breach3d, who listed the data for sale on a cybercrime forum. No authority has verified the 19 million figure. CERT-EU recorded it as "unverified".
This article treats 11.7 million as the number of record and 19 million as an unconfirmed claim, and the distinction is not cosmetic: the two counts measure different things, and one of them was produced by a seller with a commercial interest in the number being large. What is not in dispute is that the data is real. ANTS confirmed the authenticity of the resold records.
KEY FACTS
- WhatUnauthorised access to citizen account records held by the French national secure documents agency, exposing civil status and contact data. The claimed attack vector is an IDOR, a broken authorisation check, not an exploit chain, malware or a zero-day.
- WhoAgence nationale des titres sécurisés (ANTS), also referred to as France Titres, operating under the French Ministry of the Interior. 11.7 million accounts per the ministry.
- HowClaimed by the actor to be an Insecure Direct Object Reference on the API of moncompte.ants.gouv.fr, reported by Clubic. No official source has described the vector.
- DataLogin identifier, civility, surname, first names, email address, date of birth, unique account identifier. On some accounts, postal address, place of birth and telephone number. Professional accounts additionally exposed SIREN numbers, portal IDs and authorisation and settlement reference numbers.
- ActorHandle "breach3d", reported alongside "ExtaseHunters". A 15-year-old was taken into custody on April 25, 2026.
- Impact11.7 million accounts. Attachments and biometric data excluded at this stage; document numbers not reached. CNIL notified under GDPR Article 33; the Paris prosecutor seized; the Inspection générale de l'administration tasked with establishing the chain of responsibility.
WHAT HAPPENED
ANTS detected the incident on April 15, 2026. The agency operates the single national portal through which French residents apply for and track passports, national identity cards, driving licences, residence permits and vehicle registration certificates. Account holders are, by definition, people who hold or are applying for a state identity document.
An actor using the handle breach3d posted a listing on a cybercrime forum offering ANTS data for sale. Cybernews reported the listing alongside a second handle, "ExtaseHunters", and described sample records containing full names, email addresses, dates of birth, addresses and telephone numbers. ANTS subsequently confirmed both the breach and the authenticity of the resold data. The cybercrime section of the Paris prosecutor's office was seized on April 16, 2026, one day after detection.
The Interior Ministry published its first communiqué, "Incident de sécurité relatif au portail ants.gouv.fr", on April 20. It confirmed detection on April 15 and stated that the incident potentially involved disclosure of data from both personal and professional accounts. Two notifications were named: CNIL, "conformément à l'article 33 du RGPD", and a signalement transmitted to the Procureure de la République.
The ministry stated that investigations were ongoing to "déterminer précisément l'origine de l'incident et son ampleur", and committed to publishing regular points d'étape "dans un souci de transparence".
On April 21 the ministry fixed the figure at 11.7 million. " The communiqué AFP refers to has not been retrieved for this article; the figure rests on the wire copy. Earlier reporting had put the total at up to 10 million, so the ministry's figure revised the estimate upward.
On April 23, ANTS notified all potentially affected account holders by email.
On Saturday April 25, a 15-year-old was placed in garde à vue. CERT-EU recorded that the minor used the persona breach3d. On April 29 a judicial investigation was opened, with the parquet seeking mise en examen and judicial supervision, passing the matter to an investigating magistrate. The Paris prosecutor's office announced the case publicly on April 30, five days after the custody began.
Prosecutor Laure Beccuau named two offences: "accès et maintien frauduleux dans un système de traitement automatisé de données à caractère personnel mis en œuvre par l'État" and "extraction frauduleuse de données contenues dans un système de traitement automatisé de données à caractère personnel mis en œuvre par l'État". Both carry "sept ans d'emprisonnement et 300.000 euros d'amende". Beccuau put the volume offered for sale on cybercriminal forums at between 12 and 18 million lines of data.
Separately, Interior Minister Laurent Nuñez referred the incident to the Inspection générale de l'administration "pour établir la chaîne de responsabilité dans cet incident sérieux, la sûreté numérique étant un enjeu collectif majeur".
TECHNICAL ANALYSIS: WHAT AN IDOR MEANS HERE
Clubic reported the vector in precise terms: "Le vecteur d'attaque revendiqué est une vulnérabilité IDOR (Insecure Direct Object Reference) sur l'API du portail moncompte.ants.gouv.fr." The word revendiqué matters. This is the vector claimed by the actor, not a finding published by ANTS or the ministry.
The mechanism described is the simplest access-control failure that exists. Per Clubic: "Il suffisait de modifier un identifiant dans une requête pour consulter les données d'un autre citoyen", and "le système ne vérifiait pas si la personne qui consultait une fiche avait le droit de le faire". An authenticated user changes a numeric or otherwise guessable identifier in an API request and receives another person's record, because the application authenticates the session but never checks whether that session is entitled to the object requested.
The actor is reported to have called the flaw a "faille vraiment stupide". That phrase should be handled carefully. " The fuller first-person rendering, "c'était une faille vraiment stupide", is Clubic's, and Journal du Geek followed Clubic. There is no published interview or exchange in which the actor says those words. The judgement is the actor's; the sentence is a journalist's.
If the IDOR claim is accurate, there is no exploit chain here, no malware, no privilege escalation, no vulnerability in any third-party product, and no zero-day. There is one missing conditional in application code, on the API of a sovereign identity system, iterated at machine speed. That is also why no CVE exists: an authorisation flaw in a bespoke government portal is a defect in that deployment, not in a distributable product.
The most damaging material in the record is not the vector but the warning history. Léo Gonzalez of Devensys Cybersecurity told 01net he had "remonté déjà deux failles de sécurité critiques qui n'ont jamais été corrigées" to ANTS before the incident. He stated that one remained live at the time he spoke: "toujours disponible ce matin, j'ai vérifié à 7h avant de venir". His assessment of the agency is blunter still: "ils savaient depuis des années qu'ils avaient un niveau de sécurité qui n'était pas haut niveau".
Gonzalez further supposes that the still-open flaw is "sans doute" connected to the one the attackers used, but 01net presents this as his inference rather than as established fact, and this article does not treat it as a second confirmed vector.
THREAT ACTOR
The actor operated under the handle breach3d, reported alongside "ExtaseHunters" by Cybernews. Attribution here is unusually direct: CERT-EU states that the minor taken into custody on April 25 used the persona breach3d. This is not a state-sponsored operation, an organised ransomware crew or an espionage campaign. No formal technical attribution to any known group has been issued, and none is claimed.
Cybernews also reported an earlier, separate claim from September 2025 involving 12 to 13 million ANTS records, which was never confirmed by the agency. Whether that claim is related to the 2026 incident, or drew on the same weakness, is unresolved.
WHAT WAS EXPOSED
Per the Interior Ministry communiqué, for personal accounts:
- Login identifier (identifiant de connexion)
- Civility (civilité)
- Surname and first names
- Email address
- Date of birth
- Unique account identifier
- On some accounts only: postal address, place of birth, telephone number
For professional accounts, Le Monde Informatique reported the exposure of SIREN company registration numbers, portal IDs, and authorisation and settlement reference numbers, affecting the garages, driving schools and intermediaries that transact with ANTS on behalf of clients.
Stated as not disclosed, with the source of each exclusion identified:
- Attachments and biometric data. AFP quotes the ministry communiqué directly: "À ce stade, les investigations menées excluent la divulgation de données complémentaires transmises dans le cadre de la réalisation des différentes démarches, telles que les pièces jointes et les données de biométrie." The qualifier "à ce stade" is the ministry's own. Le Monde Informatique specifies the attachments as including invoices, livret de famille records and scans of passports and national identity cards.
- Illegitimate account access. The April 20 communiqué states: "Ces données personnelles ne permettent pas d'accès illégitime au compte du portail." Later wire reporting renders this as applying to the "compte nominatif sur le portail".
- Identity document numbers. The ANTS notification email of April 23, reported by Journal du Geek, states that passport application numbers, driving licence documents and vehicle registration data were not reached.
This determines the character of the harm and it should be stated plainly rather than inflated. This is not an exposure of identity document numbers, and it does not create the irremediable document-to-person linkage that a leak of passport or licence numbers would. It is narrower than that.
It is also not trivial, for three reasons. First, the combination of civility, surname, first names, date of birth and place of birth is complete French état civil, and date and place of birth are immutable. Second, membership of the dataset is itself the intelligence: every record identifies a person who holds or is applying for a state identity document, which is precisely the pretext a fraudster needs.
Third, ANTS acknowledged this directly, warning holders to be very vigilant about suspicious or unusual messages by SMS, telephone or email appearing to come from ANTS, and conceding the data could be used for phishing and social engineering.
TECHNICAL FAILURE CHAIN
Every control below is downstream of this one. A vulnerability report that generates no fix is not a near miss; it is the breach, delayed.
Authentication was enforced; authorisation was not.
Sequential or otherwise predictable identifiers turn a single missing check into a full-table read.
A single authenticated session pulling records at that volume is not a subtle signal, and it ran long enough to assemble a dataset ANTS itself has confirmed as authentic.
During that gap the only quantified number in public circulation was the seller's, which is how an unverified 19 million became the headline figure in much of the coverage.
ANTS stated only that the security of the site had been reinforced, a claim Gonzalez contests directly with a same-morning check.
INDICATORS OF COMPROMISE
- breach3d
- ExtaseHunters (reported alongside breach3d by Cybernews)
- ants.gouv.fr
- moncompte.ants.gouv.fr (portal API named as the claimed IDOR location)
- No CVE identifier has been assigned. The claimed flaw is an application-layer authorisation defect in a bespoke government portal, not a vulnerability in a distributable product, and is therefore outside CVE scope.
- ClassInsecure Direct Object Reference, broken object level authorisation.
- April 15, 2026: incident detected by ANTS
- April 16, 2026: cybercrime section of the Paris prosecutor's office seized
- April 20, 2026: Interior Ministry communiqué published
- April 21, 2026: ministry states 11.7 million accounts, carried by AFP
- April 23, 2026: ANTS notifies potentially affected account holders by email
- April 25, 2026: 15-year-old placed in garde à vue
- April 29, 2026: judicial investigation opened
- April 30, 2026: Paris prosecutor announces the case publicly
- 18 to 19 million records offered in the forum listing
- Record schema including a "statut de vérification" field
- 19 million, recorded by CERT-EU as unverified
The only volume figure from an official source is the Paris prosecutor's 12 to 18 million lines offered for sale.
No malware, no C2 infrastructure, no file hashes and no malicious domains have been reported in connection with this incident, consistent with a parameter manipulation attack against a web API.
REGULATORY EXPOSURE
- GDPR Article 5(1)(f)integrity and confidentiality. A processing system holding the civil status of 11.7 million people failed to prevent unauthorised access to records outside the requesting user's entitlement.
- GDPR Article 32 - security of processing. Object-level authorisation is a baseline technical measure, not an advanced control. The Gonzalez account, if borne out, converts this from a design failure into a remediation failure: Article 32 requires a process for regularly testing and evaluating effectiveness, and a critical vulnerability reported and left uncorrected is the clearest available evidence that no such process functioned.
- GDPR Article 33 - notification to the supervisory authority within 72 hours. ANTS notified CNIL, citing Article 33 expressly. Detection was April 15; the ministry's public communiqué came April 20. The date of the CNIL notification itself has not been published, and Article 33 runs to the regulator, not to the public.
- GDPR Article 34 - communication to data subjects. ANTS notified potentially affected account holders by email on April 23, eight days after detection, and issued public vigilance guidance regarding phishing.
- French criminal law - the ministry transmitted a signalement to the Procureure de la République. The prosecution named fraudulent access and continued presence within, and fraudulent extraction of data from, an automated personal data processing system operated by the State. Each offence carries seven years' imprisonment and a 300,000 euro fine.
- Administrative accountability - the Interior Minister referred the incident to the Inspection générale de l'administration to establish the chain of responsibility, a route distinct from and parallel to any CNIL proceeding.
The enforcement question specific to this case is not the article mapping but whether a financial penalty is available against a state agency at all. GDPR Article 83(7) leaves it to each member state to determine whether and to what extent public authorities may be fined, and the position under French law for a body of this type is addressed in the intelligence gaps below rather than asserted here.
INTELLIGENCE GAPS
Neither ANTS nor the Interior Ministry has published a technical root cause. A post-incident statement naming the flaw class, or the IGA report, would resolve this. Until then, the vector should not be treated as established.
CERT-EU recorded 19 million as unverified. The divergence from 11.7 million may reflect rows versus accounts, padding with unrelated data, or inflation to raise resale value; none of these has been established. Publication of a forensic record count would resolve it.
Both the number and the exclusions may move.
The 11.7 million figure therefore rests on AFP wire copy quoting that document, not on the document. More broadly, interieur.gouv.fr, franceinfo and lemonde.fr all blocked automated retrieval during initial research and reached this article through a text extraction proxy; a subsequent verification pass retrieved seven French sources directly and confirmed the load-bearing quotations, but two claims that entered the draft through the proxy alone proved to be artifacts of the extraction step rather than content of the pages. Any assertion here not corroborated by a directly retrieved source should be treated as provisional.
Detection on April 15 establishes only the tail of the timeline. Whether the data was collected over days, weeks or months is undisclosed, and this bears directly on whether the flaw was live during the unconfirmed September 2025 claim.
Whether it was fabricated, related, or an earlier harvest through the same weakness is unknown.
The applicable French provision could not be retrieved during this research, and no CNIL proceeding against ANTS has been announced.
Gonzalez states two reported critical flaws were never corrected and that one remained live on the morning he spoke to 01net. He supposes that flaw is "sans doute" connected to the one used in the breach, but that is his inference and 01net presents it as such. Whether either reported flaw is the vector, and whether either has since been fixed, is unestablished.
The 11.7 million figure is attributed to the ministry as an institution, not to a named official. The AFP sentence credits "la place Beauvau", and no verbatim statement attributable to a named minister was recovered, so none is asserted.
No mise en examen, disposal or finding has been reported, and the suspect is a minor entitled to the presumption of innocence.
ZERO|TOLERANCE Advisory
A disclosure channel that receives reports but does not fix them manufactures a documented liability trail without reducing risk. Attach a remediation SLA to every accepted report, and make breach of that SLA an item the agency head sees by name.
Move it beneath that. Bind the authenticated subject to a query filter enforced by the repository or ORM layer so that a request for an object the subject does not own returns nothing by construction. A missing check should produce an empty result, never another citizen's record.
UUIDv4 or opaque per-session handles raise the cost of enumeration substantially, but an authorisation flaw behind a random identifier is still an authorisation flaw. Do control 2 first, then this.
Set hard per-session and per-source ceilings on distinct object reads, alert on deviation from the individual account baseline, and auto-suspend sessions that breach it. On this incident, volumetric detection on record retrieval was the single control most likely to have caught the collection while it was still running.
Fail the build on any 200 response. This class of defect is invisible to unauthenticated scanning and to single-user test suites, which is why it survives in production systems that pass conventional assessment.
The ministry has already committed to regular points d'étape "dans un souci de transparence"; the test is whether those updates eventually name the vulnerability class and the remediation status, or stop at headcount.
Generic vigilance advice underperforms. Tell holders explicitly which channels ANTS will and will not use, that ANTS will never request payment or document scans by SMS or email, and give a single verifiable route for checking any purported ANTS communication.
SOURCES
CERT-EU, Cyber Brief 26-05 (April 2026) - https://cert.europa.eu/publications/threat-intelligence/cb26-05 Ministère de l'Intérieur, "Incident de sécurité relatif au portail ants.gouv.fr", April 20, 2026 - https://www.interieur.gouv.fr/actualites/communiques-de-presse/incident-de-securite-relatif-au-portail-antsgouvfr AFP, carried by Stratégies, "Le ministère de l'Intérieur confirme la fuite de données de l'ANTS", April 22, 2026 - https://www.strategies.fr/actualites/marques/LQ6110149C/le-ministere-de-linterieur-confirme-la-fuite-de-donnees-de-lants.html ICI, Pheline Leloir-Duault, "Cyberattaque contre l'ANTS : un mineur de 15 ans soupçonné d'être derrière la fuite de données placé en garde à vue", April 30, 2026 - https://www.ici.fr/infos/faits-divers-justice/cyberattaque-contre-l-ants-un-mineur-de-15-ans-soupconne-d-etre-derriere-la-fuite-de-donnees-place-en-garde-a-vue-2172286 Le Monde Informatique, Jacques Cheminat, "Permis, CNI, passeports : vol de données après la cyberattaque de l'ANTS", April 20, 2026 - https://www.lemondeinformatique.fr/actualites/lire-permis-cni-passeports-vol-de-donnees-apres-la-cyberattaque-de-l-ants-99969.html Journal du Geek, Florent Erculisse, "Cyberattaque du site ANTS : ce que l'on sait de la fuite qui concerne 19 millions de Français", April 23, 2026 - https://www.journaldugeek.com/2026/04/23/cyberattaque-du-site-ants-ce-que-lon-sait-de-la-fuite-qui-concerne-19-millions-de-francais/ Clubic, Alexandre Boero, "L'ANTS piratée à cause d'une faille basique et 19 millions de Français en font les frais une fois de plus", April 20, 2026 - https://www.clubic.com/actualite-609775-l-ants-piratee-a-cause-d-une-faille-basique-et-19-millions-de-francais-en-font-les-frais-une-fois-de-plus.html Clubic, Alexandre Boero, "Piratage de l'ANTS, le gouvernement fait des révélations sur la fuite de données qui concerne des millions de Français", April 22, 2026 - https://www.clubic.com/actualite-610111-piratage-de-l-ants-le-gouvernement-fait-des-revelations-sur-la-fuite-de-donnees-qui-concerne-des-millions-de-francais.html 01net, Florian Bayard, "Hack de l'Agence nationale des titres sécurisés : 2 failles de sécurité n'ont jamais été corrigées, tacle un chercheur", April 23, 2026 - https://www.01net.com/actualites/hack-agence-nationale-titres-securises-2-failles-de-securite-nont-jamais-ete-corrigees-tacle-un-chercheur.html franceinfo, "Fuite de données sur le portail de l'ANTS : près de 12 millions de comptes concernés, annonce le ministère de l'Intérieur", April 21, 2026 - https://www.franceinfo.fr/internet/securite-sur-internet/cyberattaques/fuite-de-donnees-sur-le-portail-de-l-ants-pres-de-12-millions-de-comptes-concernes-annonce-le-ministere-de-l-interieur_7954181.html FrenchBreaches, origin of the "faille vraiment stupide" fragment, the 18 to 19 million listing figure and the actor's claimed record schema; page carries a "Mise à jour le 21 avril à 22h00" stamp.
Domain defanged at source and not linked here.
Cybernews, "ANTS hack: France, 19 million records, ID agency breach" - https://cybernews.com/security/ants-hack-france-19-million-records-id-agency-breach/ SC Media, "France Titres data breach: 19 million records allegedly stolen" - https://www.scworld.com/brief/france-titres-data-breach-19-million-records-allegedly-stolen