Imprimerie Nationale: leak of the software handling French secure documents

On 18 April 2026, IN Groupe — the French state-owned company formerly known as the Imprimerie Nationale, which designs national ID cards, electronic passports, driving licences and secure digital-identity solutions for France and many foreign governments — was named in a cybercrime-forum listing offering internal software attributed to the group for sale.

The threat actor advertised what they described as "Smart Card Middleware Desktop," a software component said to sit within France's secure-document ecosystem. According to the listing, the software handles interaction with smart cards, digital certificates, cryptographic key lifecycle and specialised secure-hardware devices. The seller framed it as offering insight into the inner workings of the identity infrastructure rather than as a dump of personal data.

Reported capabilities described in the leaked component included:

• Smart-card management and provisioning
• Root certificate access and digital-certificate handling
• Cryptographic key lifecycle management
• Electronic-signature modules
• Interaction with secure hardware components

The attack vector is unclear, and the material could plausibly originate from legacy development, a third-party contractor, a compromised workstation, or be taken out of context. No personal-data breach has been confirmed, and the risk centres on architectural exposure that could help adversaries study the system and probe for vulnerabilities in France's identity infrastructure. As of reporting, IN Groupe had not publicly confirmed the authenticity of the material or whether its systems were directly compromised, leaving the incident's status unknown. This sale is distinct from the separate ANTS (Agence Nationale des Titres Sécurisés) data breach reported in France days later, around 20 April 2026.