French ANTS

The Agence nationale des titres sécurisés (ANTS), the French government agency that handles passport, identity card, driving licence and vehicle registration applications, was hit by a cyberattack that exposed personal data belonging to millions of users of its ants.gouv.fr portal. According to our investigation team, the indexed dataset contains 3,288,709 rows, with the estimated attack date on or around March 15, 2026. French authorities, however, have given a larger picture: the Interior Ministry said in April 2026 that up to 11.7 million accounts may have been affected. The agency says it detected the intrusion on April 15 and that no identity documents, attachments or biometric data were exposed. As of September 25, 2026, no attacker has been formally attributed to the listing in the records, although a hacker using the pseudonym "breach3d" publicly claimed in April to hold an ANTS database, a claim the authorities have not confirmed.

Breach Timeline

April 15, 2026: ANTS detected a security incident that could involve a data disclosure from individual and professional accounts on the ants.gouv.fr portal, according to the agency's own notice.

April 20, 2026: The agency and the Interior Ministry made the incident public and said the incident had been reported to the CNIL data protection authority, the Paris prosecutor's office, and ANSSI, France's cybersecurity agency.

April 21, 2026: The Interior Ministry stated that up to 11.7 million accounts could be affected, as reported by Le Monde.

April 23, 2026: A claim surfaced from a cybercriminal using the pseudonym "breach3d," asserting possession of a large ANTS database, RTL reported.

April 24, 2026: The portal was taken offline for maintenance to strengthen security, TF1 Info reported.

What Information Was Compromised?

Our analysis found the following data types in this breach: email addresses. The exact number of email addresses exposed in the indexed dataset could not be determined.

The agency's own security notice lists additional fields: login identifiers, civility, last names and first names, dates of birth, and unique account identifiers. In some accounts, the notice says, postal addresses, places of birth, and telephone numbers may also have been involved.

Not every individual is affected by every type of data listed here.

What Are the Potential Risks for Affected Individuals?

The exposed data does not include passwords, attachments, or biometric records, and the government says it cannot be used on its own to break into ANTS accounts. The main risk is targeted phishing. Someone holding your name, email, date of birth, and possibly your phone number or address can craft convincing messages that appear to come from ANTS or other government services. French authorities have specifically warned users about suspicious emails, texts, and calls presenting themselves as the agency. Fraudsters could also use the data for identity impersonation in scams, such as fake administrative requests or payment demands.

What Is French ANTS Doing in Response?

ANTS notified the CNIL under GDPR Article 33, filed a criminal complaint with the Paris prosecutor's office, and alerted ANSSI. Investigations began immediately after detection and are being carried out by the agency with the relevant government services. The Interior Minister also asked the Inspectorate General of Administration to establish the chain of responsibility. Starting April 24, the agency took its portal offline for maintenance to reinforce security, temporarily suspending access to residency permit applications. The agency began notifying affected users individually by email. Separately, the association Ligue des Libertés filed a complaint against the state with the CNIL and sought compensation, La Tribune reported.

What Should You Do If You Were Affected?

Check your email for a notification from ANTS or France Titres.

Change your ANTS account password, and consider changing the password of any identity provider you use through FranceConnect.

Be skeptical of emails, texts, or calls claiming to come from ANTS. Never share sensitive information by phone or click links in unexpected messages.

Report unusual activity on your account through the agency's contact form.