France’s Agence Nationale des Titres Securises (ANTS), the national agency responsible for processing passport, national identity card, driver’s licence, and residency document applications, confirmed this week that a cyberattack detected on April 15 may have exposed personal data from individual and professional accounts on the ants.gouv.fr portal. The French Interior Ministry confirmed that data from approximately 12 million accounts may have been compromised.
The compromised data includes login ID, title, full name, email address, date of birth, and unique account identifier. In some cases, postal address, place of birth, and telephone number were also exposed. ANTS confirmed that attachments submitted during document application procedures, biometric data, and account passwords were not compromised. The agency stated that the stolen data cannot be used to gain unauthorized access to ANTS portal accounts.
A threat actor using the alias “breach3d” claimed responsibility shortly after the incident, posting on hacking forums and offering to sell the dataset. The threat actor claimed to hold up to 19 million records, a figure significantly higher than the Interior Ministry’s confirmed estimate of approximately 12 million. The claim of 19 million records is unverified and represents the threat actor’s own assertion, not a figure confirmed by French authorities.
ANTS reported the incident to France’s data protection authority (CNIL), notified prosecutors, and alerted the national cybersecurity agency. Affected account holders are being notified directly by ANTS. The Interior Ministry said the stolen data “does not allow unauthorised access to the individual account on the portal” and urged users to remain vigilant against phishing attempts and suspicious messages appearing to originate from the agency.
Just two months earlier, France signed a coordination agreement for EUDI Wallet implementation. CNIL, which is now receiving the breach notification, previously flagged unlawful deployment of facial recognition by French police in a 2023 investigation into French police facial recognition use.
Sources: Connexion France, TechCrunch, Bleeping Computer
–
By Cass Kennedy
