France's ID Agency Got Hacked. 19 Million Citizens' Data Is for Sale.

Eiffel Tower and Paris cityscape under cloudy sky at dusk — Photo via Unsplash

TL;DR: On April 15, 2026, France Titres (formerly ANTS), the government agency that processes every passport, national ID card, and driver's license in France, detected a breach of its ants.gouv.fr portal. By April 16, a threat actor calling themselves "breach3d" was already selling the data on criminal forums, claiming 19 million records. The French Interior Ministry didn't publicly confirm the breach until April 23, a full week later. ANTS has since acknowledged 11.7 million accounts were impacted. The stolen data includes names, emails, dates of birth, postal addresses, phone numbers, and unique account IDs. Passwords and actual identity document attachments were reportedly not taken. Two threat actors, "breach3d" and "ExtaseHunters", are marketing the data as fresh. This is the fourth major French government data breach in recent months.

What Happened

France Titres runs the portal where French citizens apply for passports, national ID cards, driver's licenses, and vehicle registrations. If you're French and you need a government-issued document, you go through ants.gouv.fr. It's the single digital front door for identity in France.

On April 15, 2026, ANTS detected what it called "a security incident that may involve disclosure of data from both individual and professional accounts" on the portal ^[1] ^[2]. That careful bureaucratic phrasing masks what actually happened: someone broke in and grabbed the personal details of millions of citizens.

By the next day, April 16, a threat actor using the alias "breach3d" posted on a criminal forum, offering what they claimed was 19 million records from France Titres for sale ^[3] ^[4]. A second actor, "ExtaseHunters," appeared to be marketing the same data. Both emphasized this was a fresh, structural compromise, not recycled data from an older breach ^[5].

The French Interior Ministry confirmed the breach publicly on April 23 ^[6]. That's eight days between detection and public acknowledgment. Eight days where millions of French citizens had no idea their identity data was circulating on criminal marketplaces.

What Was Stolen

According to ANTS and confirmed by multiple security researchers who examined the forum listings, the stolen data includes ^[1] ^[2] ^[5]:

Login IDs
Full names
Email addresses
Dates of birth
Unique account identifiers
Postal addresses
Places of birth
Phone numbers
Gender information
Civil status

ANTS says the breach did not include document attachments (scanned passports, photos), procedural data, or account passwords ^[2] ^[5]. That's the one piece of halfway decent news here.

But let's be clear about what attackers did get. Name, date of birth, place of birth, postal address, and civil status. That's enough to pass most identity verification checks in France. That's enough to open bank accounts, file fraudulent tax returns, or impersonate someone to government services. You don't need a scan of someone's passport when you have every piece of information on the passport.

The Numbers

The threat actors claim 19 million records, roughly one-third of France's population ^[3] ^[5].

ANTS initially hedged, then confirmed that 11.7 million accounts were impacted ^[4]. That's still an extraordinary number. France has about 68 million people. Whether it's 11.7 or 19 million, we're talking about one out of every four to six French citizens.

And these aren't just random email addresses. These are people who used a government portal to apply for identity documents. The dataset is inherently high-value because everyone in it has verified their real identity with the French state.

France's Government Breach Problem

Here's what makes this worse: it's not an isolated incident. France has been hemorrhaging government data for months.

February 2026: The National Bank Accounts File was breached, exposing 1.2 million accounts ^[7]
Late 2025: The ÉduConnect education platform was compromised, leaking student data ^[7]
Recent months: A doctors' ministry service breach exposed 15.8 million medical records ^[7]
Now: France Titres, the identity document portal itself, with up to 19 million records

That's bank data, education data, medical data, and identity data. Four different government systems. Tens of millions of records. There's a pattern here, and it isn't a flattering one.

The French government is simultaneously pushing mandatory digital identity programs while proving, repeatedly, that it can't protect the centralized databases those programs create. Every new mandatory digital service is a new target. Every citizen forced onto a government portal is another row in a database waiting to be stolen.

The Centralization Trap

France Titres is the textbook example of why centralizing identity data is dangerous.

Before digital portals, your passport application was a paper form in a locked filing cabinet at a local prefecture. Stealing it meant physically breaking into a building. Scaling that attack meant breaking into thousands of buildings across France.

Now it's all in one database. One portal. One target. And the value of that target grows with every citizen the government forces to use it, with every data field it collects, with every new document type it adds to the system.

When (not if) someone finds a way in, they don't get one person's information. They get 19 million people's information. The efficiency that makes centralized identity management attractive to governments is the same efficiency that makes it attractive to criminals.

France's Response

The Interior Ministry's statement was boilerplate: "technical investigations are ongoing" to determine the breach's origin and scope ^[2] ^[5]. ANTS teams and "relevant services" are investigating. Additional security measures have been implemented. Specifics remain undisclosed.

ANTS warned users about potential phishing attacks in the near future from criminals posing as the agency ^[2]. That's useful but also an admission: the agency knows the data is already out there and being used.

What's missing from the response: how the breach happened, how long attackers had access, why it took eight days to go public, and what structural changes will prevent the next one. "We're investigating" is not a plan. It's a stall.

If You Have a France Titres Account

Assume Your Data Is Compromised

If you've used ants.gouv.fr to apply for a passport, ID card, driver's license, or vehicle registration, treat your personal data as exposed. Don't wait for an official notification letter.

Watch for Government Impersonation Scams

Criminals now have enough data to send convincing phishing emails and SMS messages that look exactly like official France Titres communications. Any message asking you to "verify your identity," "update your account," or "confirm your application" should be treated as suspicious. Go to ants.gouv.fr directly, never click links in messages.

Monitor for Identity Fraud

With names, dates of birth, places of birth, and addresses, identity theft becomes much easier. Monitor your bank accounts, check your credit reports, and watch for any government correspondence about applications you didn't file. In France, you can request a copy of your Banque de France file to check for unauthorized credit activity.

Change Your Passwords Anyway

ANTS says passwords weren't stolen. Change yours anyway. If you used the same email/password combination for other French government portals (FranceConnect, Ameli, impots.gouv.fr), change those too. Enable two-factor authentication wherever it's available.

The Bottom Line

A government agency that exists to secure identity documents couldn't secure its own database. The irony writes itself.

France Titres holds some of the most sensitive data any government collects, the verified identity of its citizens. That data is now for sale on criminal forums. And this isn't a one-off failure; it's the fourth major French government breach in months.

Every time a government mandates digital identity, it creates a centralized honeypot. Every time it says "trust us with your data," it's making a promise. France just broke that promise for the fourth time. At some point, the question stops being "how did this happen?" and becomes "why do we keep building systems designed to fail at this scale?"

References

Published: April 26, 2026