French ID and Passport Agency Confirms Data Breach Affecting Millions of Records

France's national authority responsible for issuing identity documents has acknowledged a significant cybersecurity incident that exposed personal information of potentially millions of citizens.

France Titres, officially known as the Agence nationale des titres sécurisés (ANTS), confirmed on April 16 that it had discovered a data breach the previous day. An unknown threat actor subsequently claimed responsibility for the incident, asserting possession of approximately 19 million records allegedly obtained from the agency's systems. As of the announcement, the stolen data had not been distributed widely across public channels, according to security researchers at Bleeping Computer.

Scope of the Breach

The affected agency maintains responsibility for issuing and managing critical identity documents across France, encompassing driver's licenses, national ID cards, passports, and immigration-related paperwork.

The compromised dataset contains sensitive personal information, including:

• Full names
• Email addresses
• Dates of birth
• Account identifiers and login credentials
• Telephone numbers
• Mailing addresses

Official Assessment and Warnings

French authorities determined that the intrusion did not grant unauthorized access to the agency's operational portals. However, officials cautioned that the exposed information could be leveraged for phishing campaigns and other malicious activities. The department urged the public to remain vigilant against any suspicious communications purporting to originate from France Titres.