15 April 2026
France Titres / ANTS
Government Identity / public services
France Titres, also known as ANTS, detected a security incident on 15 April 2026 involving the ants.gouv.fr portal. The 21 April official update said about 11.7 million individual and professional accounts could be concerned.
That figure is phrased as accounts that may be concerned. It should not automatically be read as 11.7 million complete records definitely downloaded. Criminal claims of roughly 18 to 19 million records are not the official count.
Dated facts in the public record
ANTS detects the security incident.
ANTS reports to the Paris prosecutor that data presented as coming from the incident is being offered for sale. A cyber investigation begins.
Official update: 11.7 million accounts may be concerned. Technical investigation of origin and scope is still ongoing.
ANTS places the portal into maintenance from 19:30 to continue security strengthening.
A 15-year-old suspect is arrested.
Paris prosecutor publicly announces the arrest and says the minor is suspected of having contributed to the leak.
How it happened
The principal ANTS update does not name an initial-access vector or vulnerability. It says internal technical investigations are working to establish origin and scope. Later journalism described an IDOR-style API weakness; researchers also said they had previously reported security flaws. Those accounts remain reporting unless France Titres, investigators or a judicial record confirms the specific technical path.
What was exposed
Potentially affected fields include login identifier, civil-status title, surname and given names, email, date of birth and a unique account ID. For some accounts the dataset also includes postal address, place of birth and phone number. ANTS said the disclosed fields by themselves did not allow someone to log into the named ANTS account.
What was not in scope
At the 21 April stage, ANTS excluded supporting documents uploaded for administrative procedures and biometric data. Passwords were not listed among the disclosed fields.
What it meant in practice
The data is highly suitable for government-themed identity phishing. A fraudster can cite a real date of birth, address or ANTS context and impersonate a driving-licence, passport, registration or identity-document process. The main direct danger is not that the leaked fields themselves unlock the portal, but that they make the next social-engineering step more convincing.
Attacker claim (not a confirmed count)
Sellers on criminal forums claimed a larger dataset, generally in the 18 to 19 million-record range. Official government communications used 11.7 million accounts as the potential scope. The later arrest of a minor suspected of contributing to the leak does not validate the advertised volume.
What was done next
ANTS notified CNIL, referred the matter to the Paris prosecutor, and an OFAC investigation was opened. The Interior Minister asked the Inspection générale de l’administration to establish the chain of responsibility. Professional and individual users were informed. ANTS advised password changes at the next login as a precaution. The portal was later placed in maintenance for additional hardening.
What later reporting changed
A 15-year-old was arrested on 25 April. On 30 April the Paris prosecutor said the minor was suspected of having contributed to the data leak. A government information page that mistakenly referred to detection on 15 March is not used here: primary ANTS and Interior Ministry material consistently says 15 April.
In their words
11.7 million accounts may be concerned
Original 11,7 millions de comptes seraient concernés
France Titres / Interior Ministry, 21 April 2026
internal technical investigations
Original investigations techniques internes
France Titres, 21 April 2026
What does this mean?
- Phishing
- A message or call that imitates a real organisation to get you to hand over a password, a code or a payment.
- IDOR
- Insecure Direct Object Reference: changing an identifier in a request to see someone else’s record because the server does not check that you are allowed to.