12 million people in the ANTS data leak

On 20 April 2026, ANTS (France Titres) — the French national agency that issues secure identity documents such as passports, national ID cards, driving licences and vehicle registration certificates — confirmed a large-scale leak of personal data from its online account portal, moncompte.ants.gouv.fr. The intrusion was detected on 15 April and disclosed in the days that followed, with the Interior Ministry confirming the scale on 20 April.

Security researchers attributed the breach to an Insecure Direct Object Reference (IDOR) vulnerability in the portal's API: by altering a single identifier in a request, an attacker could iterate through and pull data belonging to other users. The day after detection, a threat actor using the alias "breach3d" advertised the stolen dataset for sale on a criminal forum, claiming up to 18–19 million records — though the Interior Ministry put the official figure at 11.7 million affected accounts.

The exposed data included:

• Login identifier, civility/gender and account identifier
• Full name, date of birth and place of birth
• Email address, postal address and phone number

Scanned identity documents and other attachments uploaded by users in support of their title requests were reportedly not part of the leak. France Titres said the exposed fields do not by themselves allow unauthorized access to its portals, but warned users to stay highly vigilant against phishing and suspicious messages exploiting the data.

The agency closed the vulnerability and notified the CNIL (data protection regulator) and ANSSI (national cybersecurity agency), and filed a complaint with the Paris public prosecutor. Investigations into the breach and the data sale were ongoing at the time of disclosure.