France's ANTS confirms data breach of citizen identity records

The Agence Nationale des Titres Sécurisés (ANTS), which is the French government agency responsible for issuing and managing identity documents, confirmed on Wednesday that it experienced a data breach. As the state agency that handles the issuing and management of citizens’ identity documents, ANTS is responsible for critical records including national identity cards, passports, and immigration documents. In an official announcement, the agency stated that the data stolen in the breach could include sensitive personal details. Specifically, ANTS disclosed that the compromised information could include citizens’ full names, dates and places of birth, mailing addresses, email addresses, and phone numbers. The agency noted that this potential exposure applies to an undisclosed number of citizens, while the investigation to determine how the breach happened and its impact remains ongoing.

While ANTS did not specify the exact number of individuals affected by the security incident, some reporting suggests that millions of people may have had some of their personal information stolen. According to the technology news publication Bleeping Computer, a hacker has advertised the stolen data on an online hacking forum. The hacker is claiming to have a database containing 19 million records. The hacker’s forum post referenced the same kind of stolen information as mentioned in ANTS’ announcement, indicating that the advertised database aligns with the categories of data that the agency confirmed could be compromised in the breach.

The timeline of the incident indicates that ANTS first detected the attack on April 15. The hacker’s forum post advertising the database was published before ANTS publicly disclosed the breach on April 20. Following these events, the agency officially confirmed the data breach on Wednesday. ANTS has stated that its investigation to determine how the breach happened and to assess its full impact is currently ongoing. Additionally, the agency confirmed that it is in the process of notifying the individuals whose personal data was affected by the security incident, as authorities work to contain the fallout.

Why it matters

The breach of a central government identity agency highlights the persistent vulnerability of state-held citizen data, even as authorities work to contain the fallout and notify affected individuals.