19 Million French Identities for Sale: When the Agency Issuing Your Documents Loses Your Data

On April 15, 2026, the detection systems of France Titres — the French government agency previously known as ANTS, Agence Nationale des Titres Sécurisés — generated an alert on anomalous internal activity within the ants.gouv.fr portal, the web infrastructure through which French citizens request and manage passports, electronic ID cards, driving licenses, and vehicle registrations. The internal response was textbook: containment, isolation of the affected system, activation of the mandatory GDPR notification chain. CNIL (the French data protection authority), ANSSI (the national cybersecurity agency), and the Paris Public Prosecutor were involved according to procedure.

On April 16, on the boards of a known English-language criminal forum, a sale listing signed "breach3d" appeared — an alias also used as "ExtaseHunters" and in some reconstructions as part of a collective including "EvilDump". The listing contained a sample of the data and a starting price in seven figures for the complete dataset: between 18 and 19 million records relating to French citizens with ants.gouv.fr accounts. To put it in perspective: France has roughly 68 million inhabitants, of whom about 53 million are adults. The dataset touches, by the actors' own estimate, more than a third. By demographic impact, it is one of the most extensive breaches ever documented against a European state agency.

The French government confirmed the incident on April 21, six days after detection, with a statement describing exposure as "potential" and specifying the data categories involved. Individual notifications to data subjects have been initiated. The initial technical vector was not publicly disclosed, but the operational fingerprints are consistent with MITRE ATT&CK category T1190 — Exploit Public-Facing Application: a vulnerability on the internet-facing web application, exploited to gain access to the backend and databases.

What Was Exfiltrated (and What Was Not)

Precision on this point is crucial, because it determines the risk class for each affected citizen. According to France Titres communications and samples published by attackers on forums, exfiltrated data include: login identifier, full name and surname, email address, date of birth, unique account identifier, and for a portion of the records also postal address, place of birth, phone number, gender, and civil status. This is the typical user account dataset on a public services portal, not the complete corpus of an identity document.

What, according to currently available reconstructions, was not exfiltrated: the identification numbers of issued documents (passport, ID card, license), biometric images (photos, fingerprints) custodied for document printing, digitized handwritten signatures, scans of supporting documents uploaded by applicants. This distinction matters: without document number and biometrics, the "document cloning" scenario is remote. The realistic — and gravely probable — scenario is another.

The Probable Vector: T1190 and the Geometry of State Apps

Without an official technical communication, every vector attribution is reasoned inference. The inferences converge on one direction: a vulnerability on the public web application, probably in an account management or credential recovery endpoint, exploited to obtain unauthorized read access to a substantial portion of the user database. Specific hypotheses include SQL injection — the vulnerability class most historically associated with mass account exfiltrations — IDOR (Insecure Direct Object Reference) on APIs enumerating records by ID, or abuse of a legitimate administrative export function through a compromised session.

European government applications share a typical architecture that amplifies risk: they are often built as monolithic PHP or Java EE on centralized relational databases, evolve by stratification (one module added on top of another over years), are subject to compatibility constraints with internal legacy systems, and operate under budget constraints making systematic security refactoring an exception rather than a rule. The result is that a flaw in an apparently secondary endpoint — a password recovery form, an "eligibility check" page, an internal lookup API — can open access to the entire user corpus. The ants.gouv.fr portal is structurally not different, in this, from SPID, the IO app, or the Anagrafe Nazionale portals of our ministries.

Why an Italian Should Care: Three Direct Exposure Lines

The France Titres case is not a foreign chronicle. For Italian professionals in sensitive roles — journalists, lawyers, corporate executives, magistrates, professionals managing high-value dossiers — there are three concrete exposure lines justifying a careful analysis of one's own risk.

First line: Italian citizens resident or with interests in France. Tens of thousands of Italians work in France, have bought second homes in the Loire region or on the Côte d'Azur, maintain French bank accounts, manage stakes in French companies. Many of them have opened accounts on ants.gouv.fr to obtain a residence permit, request a French driving license, manage a French spouse's documents. If your name is in that dataset, the phishing emails you will receive in the coming weeks will be crafted with real data few outside your family know. Verification: ask your French tax advisor or lawyer if you appear in CNIL notifications.

Second line: Italian phishing built on French templates. Historically, post-breach phishing waves migrate: the original dataset is sold, replicated, integrated with other datasets (LinkedIn 2021, various credential stuffing waves), and operational know-how transfers. Expect in the coming weeks Italian phishing campaigns mimicking France Titres style but adapted to SPID, INPS, Agenzia delle Entrate. Attackers who succeeded with the French will try the same technique with us. Characteristics to recognize: "personalized" email citing date of birth or address, urgency ("verify within 48 hours"), link to a domain similar but not identical to the official portal.

Third line: the geopolitics of breaches as weapon. The case fits into a European wave — Salt Typhoon on telecom (April 8, 2026), Equalize on Italian databases, APT28 PRISMEX on NATO/Ukraine (April 10, 2026) — showing progressive normalization of state dataset exfiltration as standard practice for adversarial actors. Whether breach3d is a pure criminal actor or a façade for a state-nexus group, the result does not change: the loot ends up on grey markets and becomes available to anyone paying for it. Hostile intelligence services, organized crime, political influence actors.

The Right to Know: GDPR, Notifications, and What to Demand

GDPR requires the controlling agency — France Titres — to notify the supervisory authority (CNIL) within 72 hours of discovery and the data subjects without undue delay when the breach presents high risk to the rights and freedoms of natural persons. The first obligation has been fulfilled. The second is in progress: France Titres announced progressive sending of individual notifications in the weeks following April 21.

For Italian citizens with ants.gouv.fr accounts, two practical paths are open. The first: monitor your registered email and verify the notification actually arrives — if it does not arrive by end of May, it is appropriate to proactively ask the agency, citing your account identifier, whether your data is in the compromised dataset. The second: file a complaint with CNIL (cnil.fr) if concrete harm is suffered — successful phishing, banking fraud, identity theft attributable to the breach — requesting opening of an individual file and assessment of compensable damage.

Is Italy Safe? The Italian Mirror of Risk

The implicit question every Italian decision-maker should ask is not "are we French?", it is "do we have, in Italy, the structural equivalent of France Titres?". The answer is plural and not reassuring. SPID manages authentication of millions of citizens to PA services. The IO app custodies public notifications and transactional interactions. Anagrafe Nazionale della Popolazione Residente (ANPR) custodies the registry data of all residents. Sistema TS at Agenzia delle Entrate manages health data for the pre-filled tax return. INPS administers the contribution position of tens of millions of workers. Each of these systems is, by architecture and data perimeter, a homologous or functional superset of ants.gouv.fr.

None of these systems is "certainly vulnerable" and none is "certainly safe". Recent history — the Equalize case AEGIDA analyzed on April 10, recurrent SPID vulnerabilities surfacing over the years, the 2020 INPS incident on partita IVA bonuses — suggests Italian structural defenses are no worse than French ones, but certainly no better. The difference is in case patterns: France had its public breach this week, Italy had its in waves over the years. What is missing, in both countries, is a systemic posture: legally mandatory rate-limits on state APIs, structural separation between single-record and bulk access, unified SOC-style alerting at national level.

Five Practical Moves for Italian Professionals

1. 1.Verify personal position: if you have or had an ants.gouv.fr account, check your registered email and await CNIL notification. If absent, proactively contact the agency support service by end of May 2026.
2. 2.Professional email review: assume every email apparently from a state agency (Italian or French) for the next six to eight weeks is potential phishing. Verify sender domain, access portals via direct URL, never via email links.
3. 3.Authentication hardening: where available, replace SMS-2FA with passkey or TOTP app on all accounts custodying sensitive data or PA service access — SPID level 3, IO app, Sistema TS, INPS, bank.
4. 4.For journalists and lawyers: channel separation. "Administrative" identity (SPID, bank account, state agencies) on one device, "professional" identity (correspondence with sources or clients) on a different device. Compromise of one channel must not compromise the other.
5. 5.For companies with employees managing ants.gouv.fr accounts (HR, tax, legal departments): specific operational briefing to involved employees in the next two weeks, with examples of expected phishing and escalation procedures in case of suspicion.

The Underlying Lesson: Identity Is a State Asset — and a Target

For too long in Italian public debate the security of digital identity has been treated as a bureaucratic problem — "how to issue the electronic document", "how to integrate SPID with services" — rather than as a national security problem. The France Titres case, together with the Equalize case on the other side (exposure through internal operators rather than external attackers), brings the issue back to its real level: the infrastructure certifying who we are is critical at least as much as the electric grid and payment systems, and must be treated with equal seriousness.

For Italian professionals managing valuable dossiers — correspondence with confidential sources for journalists, privileged communications with clients for lawyers, strategic decisions for executives — the operational lesson is that defense can no longer be entirely delegated to state agencies. Channel separation, control of one's digital posture, investment in devices and workflows reducing attack surface become individual responsibilities. Not because the state is inadequate, but because the state — French, Italian, or of any other jurisdiction — is itself a target, and when hit, the blast radius lands directly on its citizens.