France's ID Agency Hacked: 19 Million Citizens' Data for Sale

View of the Eiffel Tower in Paris at sunset with the city skyline in the background — Photo via Unsplash

TL;DR: France's ANTS (Agence Nationale des Titres Sécurisés), now rebranded as France Titres, confirmed on April 15, 2026 that hackers breached the ants.gouv.fr portal. This is the agency that handles every French passport, national ID card, driver's license, and vehicle registration. A threat actor using the alias "breach3d" posted 18–19 million stolen records for sale on criminal forums the very next day. The exposed data includes full names, dates of birth, email addresses, postal addresses, phone numbers, and account identifiers. Security researchers traced the attack to an Insecure Direct Object Reference (IDOR) vulnerability in the ANTS API, a flaw so basic the attacker called it "really stupid." Scanned identity documents were reportedly not accessed. CNIL, ANSSI, and the Paris Public Prosecutor are investigating. If you hold a French identity document, you should assume your data is compromised.

What Happened

On April 15, 2026, ANTS detected unauthorized access to user accounts on its portal. One day later, on April 16, a threat actor operating under the aliases "breach3d" and "ExtaseHunters" posted a listing on a hacker forum claiming to have successfully compromised the agency's infrastructure ^[1] ^[2].

The claimed haul: between 18 million and 19 million records. That's roughly one third of France's entire population.

Here's what was exposed, according to ANTS and independent security researchers ^[1] ^[2] ^[3]:

Full names, titles, and gender
Dates and places of birth
Email addresses and login identifiers
Postal addresses
Phone numbers (where provided)
Civil status and unique account identifiers

ANTS says scanned identity documents (copies of passports, IDs, and driver's licenses) were not accessed ^[3]. That's the only good news here. The rest is a goldmine for identity fraud.

The data hasn't been publicly dumped yet. It's sitting in private listings, which means "breach3d" is looking for buyers, not attention. That makes it harder to verify the full scope, and harder for victims to know they're exposed.

The "Really Stupid" Vulnerability

Security researchers identified the attack method as an Insecure Direct Object Reference (IDOR) vulnerability in the ANTS API ^[2] ^[4].

IDOR is one of the most basic web security flaws that exists. It means the API let users access other people's data simply by changing a parameter in the request, like swapping a user ID number in the URL. No special hacking tools required. No sophisticated exploit chain. Just changing numbers.

The attacker confirmed as much, describing the flaw as "really stupid" ^[2]. For an agency that literally exists to issue secure identity documents, the irony writes itself.

IDOR vulnerabilities are consistently listed in the OWASP Top 10, the industry's standard reference for web application security risks. Any competent security audit would have caught this. Which raises the obvious question: when was the last time anyone audited the ANTS API?

The Government Response

ANTS mobilized multiple French authorities ^[1] ^[3] ^[5]:

ANSSI (Agence Nationale de la Sécurité des Systèmes d'Information): France's national cybersecurity agency, leading the technical investigation
CNIL (Commission Nationale de l'Informatique et des Libertés): France's data protection authority, notified as required under GDPR
Paris Public Prosecutor: criminal complaint filed
OFAC: engaged to lead the forensic investigation

ANTS told the public that "no immediate action is required" but warned citizens to exercise "extreme caution" around any SMS, phone call, or email appearing to come from the agency ^[3]. That's the bureaucratic equivalent of saying "don't worry, but also worry."

The agency says it's in the process of notifying directly affected users. It has not confirmed the 19 million figure. Forensic investigations remain "ongoing."

A Pattern, Not an Anomaly

This isn't an isolated incident. France has been hemorrhaging government data for months:

February 2024: The French healthcare payment system (Viamedis and Almerys) was breached, exposing data on 33 million people, nearly half the country ^[6].
Early 2026: France's national bank account registry (FICOBA) was breached, exposing 1.2 million accounts ^[7].
March 2026: The Ministry of Sports confirmed a breach of its systems ^[5].
2025: Cegedim Santé, a healthcare data processor, was breached, exposing medical records of 15 million French citizens ^[8].

When the agency responsible for issuing every identity document in the country gets popped by an IDOR vulnerability (a flaw that any junior security engineer could identify) it says something about the state of government cybersecurity in France. And not just France. Government identity systems worldwide run on aging infrastructure with security budgets that haven't kept pace with the data they hold. The same story plays out across the private sector, as the 2025 Breachies roundup documented in detail.

If You Have a French ID Document, Do This

Assume Your Data Is Exposed

ANTS handles passports, national IDs, driver's licenses, and vehicle registrations. If you've used the ants.gouv.fr portal for any of these, your personal details may be in the stolen dataset. Don't wait for a notification that may never come.

Watch for Phishing Impersonating ANTS

With names, addresses, and dates of birth in hand, scammers can craft convincing messages pretending to be from ANTS or other French government agencies. Any message asking you to "verify" your identity, click a link, or provide additional details is almost certainly a scam. Go directly to ants.gouv.fr instead.

Change Your ANTS Portal Password

Login credentials were among the exposed data. Change your password on the ANTS portal immediately. If you've used the same password anywhere else, change those too.

Monitor for Identity Fraud

The combination of name, date of birth, address, and government account data is everything a fraudster needs to impersonate you. Watch for unauthorized credit applications, unfamiliar correspondence from government agencies, or tax filings you didn't submit. In France, you can file a complaint with CNIL if you discover misuse of your data.

References

Published: April 24, 2026