France arrested a 15-year-old as the suspected hacker behind the French government ID agency breach - 11.7 million records confirmed stolen

Update on the ANTS breach we covered April 22: French police detained a 15-year-old on April 25, suspected of running the breach3d alias and stealing data from France Titres (ANTS), the agency that issues French ID cards, passports, and driver's licenses. The Paris Prosecutor's Office charged the minor on April 29 with three offenses carrying up to seven years in prison. ANTS now confirms 11.7 million accounts affected - lower than the original 19 million claim but still one of the largest leaks of French citizen identity data ever. Exposed data includes full names, email addresses, dates of birth, postal addresses, and phone numbers.

Check

If you live or operate in France, watch for highly-targeted phishing referencing real ID details over the next 90 days - the breach data is now confirmed in attacker hands.

Affected

11.7 million French residents whose ID data, contact details, and dates of birth are in the breach3d dataset. Acute risk for individuals who used these details to create accounts at French government services or banks. Organizations operating in France that use government-issued ID for KYC checks need to assume their data sources are tainted.

Fix

ANTS recommends affected users reset passwords on government and banking accounts and watch for impersonation messages claiming to be ANTS or La Poste. Treat any inbound email referencing your real ANTS data as hostile. KYC checks based on French government ID numbers should be backed by additional verification (face match, document liveness check) for the next 12 months.