French authorities detain 15-year-old suspected of breaching National ID Agency and leaking 11.7 million records

A 15-year-old boy has been taken into judicial custody in France, suspected of orchestrating a massive cyberattack against the Agence Nationale des Titres Sécurisés (ANTS) - the government body responsible for processing national IDs, passports, and driver’s licenses. The minor, who allegedly operated under the online alias "breach3d," is accused of compromising the personal data of approximately 11.7 million citizens.

The Paris public prosecutor’s office confirmed that the teen was detained on April 25, 2026, following a rapid investigation into data samples that began circulating on underground cybercrime forums earlier that month.

Millions of identities at Risk

The breach was first detected by ANTS on April 13 after "unusual activity" was spotted on the agency’s network. Within days, the hacker "breach3d" claimed to have exfiltrated a database containing between 12 million and 18 million records.

While authorities have clarified that sensitive biometric data and uploaded supporting documents were not taken, the exposed information is extensive:

• Full names and email addresses.

• Dates and places of birth

• Postal addresses and phone numbers

• Unique account identifiers and login credentials

Cybersecurity experts warn that this data is "gold" for secondary attacks, specifically highly targeted phishing campaigns and identity theft, as the stolen records allow criminals to impersonate government officials with frightening accuracy.

The "hacker" next door

The arrest has reignited the debate in France over the "democratization" of cybercrime among minors. This incident follows two other high-profile arrests this year involving teenagers: an 18-year-old accused of hacking the French Shooting Federation in January, and a 20-year-old known as "HexDex" arrested just weeks ago for targeting sports organizations.

The 15-year-old suspect faces charges of unauthorized access to a state data processing system and fraudulent extraction of data. Under French law, these offenses carry a maximum penalty of seven years in prison and a fine of €300,000. However, his age will likely lead to a different judicial path focused on supervision and rehabilitation.

Systemic vulnerabilities in "France Titres"

The hack is a significant blow to the Ministry of the Interior, especially as ANTS recently assumed responsibility for managing the nation’s new age-verification app - a tool designed to prevent children under 15 from accessing social media without parental consent.

The Ministry has launched an administrative review to assess how a teenager was able to penetrate the defenses of one of the country's most sensitive digital platforms. For now, the millions of affected French citizens are being urged to reset their credentials and remain hyper-vigilant against any unsolicited communications claiming to be from official government agencies.