{"id":"france-titres-account-data-breach-apr-2026","category":"breach","status":"closed","title":"France Titres breach potentially exposes identity data from 11.7 million accounts","tldr":"France Titres estimated 11.7 million ANTS accounts were affected by an identity-data breach. Attachments and biometrics were excluded. The portal reopened and a suspect was charged. Change your ANTS password and watch for impersonation messages.","summary":"France Titres, France's identity-document and vehicle-registration agency, disclosed a breach affecting personal and professional ANTS portal accounts on 20 April. The Interior Ministry estimated 11.7 million accounts were affected. Potentially exposed information included login identifiers, names, titles, email addresses, dates of birth and account identifiers, with postal addresses, birthplaces and telephone numbers in some accounts. The ministry excluded submitted attachments and biometric data and said the exposed information did not itself allow account access. Detection dates conflict: the ministry says 15 April, while a government explainer says 15 March. The portal closed on 24 April, reopened on 29 April and was reported operating normally by 7 May, with two-factor authentication added. An August government statement confirmed an arrest and formal charges. As of 3 November, the reviewed sources provide no later court outcome, confirmation that exposed data was recovered, or evidence establishing subsequent misuse against account holders. No device update applies.","action":"If you have a France Titres (ANTS) account, visit ants.gouv.fr directly and change its password at your next sign-in, as the ministry recommends. Watch for suspicious calls, texts and emails claiming to be France Titres, particularly requests to sign in or provide personal information.","product":"France Titres (ANTS) personal and professional portal accounts","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["france-titres","ants","france","data-breach","identity-data"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Incident de sécurité relatif au portail ants.gouv.fr","url":"https://www.interieur.gouv.fr/actualites/communiques-de-presse/incident-de-securite-relatif-au-portail-antsgouvfr","by":"French Interior Ministry","date":"2026-04-20"},{"kind":"advisory","title":"Point d’étape du 21 avril 2026 concernant l'incident de sécurité relatif au portail ants.gouv.fr","url":"https://www.interieur.gouv.fr/actualites/communiques-de-presse/point-detape-du-21-avril-2026-concernant-lincident-de-securite-relatif-au-portail-antsgouvfr","by":"French Interior Ministry","date":"2026-04-21"},{"kind":"advisory","title":"Fermeture du portail ants.gouv.fr pour maintenance","url":"https://www.interieur.gouv.fr/actualites/communiques-de-presse/fermeture-du-portail-antsgouvfr-pour-maintenance","by":"French Interior Ministry","date":"2026-04-24"},{"kind":"post","title":"France Titres : le point sur l’incident de sécurité","url":"https://www.info.gouv.fr/actualite/france-titres-le-point-sur-l-incident-de-securite","by":"French Government","date":"2026-04-24"},{"kind":"news","title":"Fuite de l’ANTS : un ado de 15 ans en garde à vue","url":"https://next.ink/briefs/le-brief-du-30-avril-2026/","by":"Next","date":"2026-04-30"},{"kind":"news","title":"Piratage de l’ANTS : retour des démarches en ligne mais le service est encore instable","url":"https://www.tomsguide.fr/piratage-de-lants-retour-des-demarches-en-ligne-mais-le-service-est-encore-instable/","by":"Tom's Guide","date":"2026-05-02"},{"kind":"post","title":"Réouverture du portail ANTS","url":"https://www.intramuros.org/saint-martin-le-beau/actualites/852675","by":"Mairie de Saint-Martin-le-Beau","date":"2026-05-07"},{"kind":"post","title":"Protection des données des Français : l'État poursuit une stratégie accélérée de sécurisation","url":"https://www.info.gouv.fr/communique/protection-des-donnees-des-francais-l-etat-poursuit-une-strategie-acceleree-de-securisation","by":"French Government","date":"2026-08-17"}],"started":"2026-04-20","closed":"2026-08-17","created":"2026-11-03T20:43:11.785Z","updated":"2026-11-03T20:43:11.785Z","cve_notes":[],"timeline":[{"at":"2026-08-17","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"The French government confirmed that the France Titres investigation had led to an arrest on 25 April and formal charges on 29 April. The statement did not announce a conviction.","url":"https://www.info.gouv.fr/communique/protection-des-donnees-des-francais-l-etat-poursuit-une-strategie-acceleree-de-securisation","by":"French Government","patch":null},{"at":"2026-05-07","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Saint-Martin-le-Beau town hall relayed ANTS's confirmation that normal portal access had returned. It said two-factor authentication had been introduced on 29 April.","url":"https://www.intramuros.org/saint-martin-le-beau/actualites/852675","by":"Mairie de Saint-Martin-le-Beau","patch":null},{"at":"2026-05-02","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Tom's Guide reported continuing errors after reopening, although it successfully started an identity-card application.","url":"https://www.tomsguide.fr/piratage-de-lants-retour-des-demarches-en-ligne-mais-le-service-est-encore-instable/","by":"Tom's Guide","patch":null},{"at":"2026-04-29","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Paris prosecutors opened a judicial investigation under an investigating judge. Next also reported that online applications and FranceConnect identification were restored that evening.","url":"https://next.ink/briefs/le-brief-du-30-avril-2026/","by":"Next","patch":null},{"at":"2026-04-25","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Police took a 15-year-old suspect into custody over suspected involvement in the breach, according to Next's subsequent report of the Paris prosecutor's statement.","url":"https://next.ink/briefs/le-brief-du-30-avril-2026/","by":"Next","patch":null},{"at":"2026-04-24","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"ANTS closed authenticated portal services from 19:30 local time to strengthen security. Users could not start or track applications, although previously completed submissions remained valid and continued to be processed.","url":"https://www.interieur.gouv.fr/actualites/communiques-de-presse/fermeture-du-portail-antsgouvfr-pour-maintenance","by":"French Interior Ministry","patch":null},{"at":"2026-04-21","added":"2026-11-03T20:32:12.437Z","kind":"vendor-revised","text":"The ministry estimated 11.7 million accounts were affected and excluded submitted attachments and biometric data. All affected professional account holders had been emailed; notifications to individuals were continuing.","url":"https://www.interieur.gouv.fr/actualites/communiques-de-presse/point-detape-du-21-avril-2026-concernant-lincident-de-securite-relatif-au-portail-antsgouvfr","by":"French Interior Ministry","patch":null},{"at":"2026-04-20","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"The Interior Ministry disclosed potential exposure of personal and professional ANTS account data, dating detection to 15 April. It said affected users were being notified, CNIL had been notified and prosecutors had received a report.","url":"https://www.interieur.gouv.fr/actualites/communiques-de-presse/incident-de-securite-relatif-au-portail-antsgouvfr","by":"French Interior Ministry","patch":"na"}],"url":"https://hard.fyi/live/france-titres-account-data-breach-apr-2026/","json":"https://hard.fyi/api/live?id=france-titres-account-data-breach-apr-2026"}