France's National ID Agency ANTS Allegedly Breached, 18 Million Citizen Records With Government-Verified Identities Listed for Sale

Summary

Threat actors EvilDump, ExtaseHunters, and Breach3d claim to have compromised ANTS (Agence Nationale des Titres Securises), France's government agency responsible for issuing passports, ID cards, and driver's licenses. The breach reportedly exposes 18 million records—approximately one-third of France's adult population—including full names, birth dates, addresses, email addresses, phone numbers, and critically, government-verified identity certification flags. The attackers are listing the database for sale on dark web forums, with the certification status making these records exceptionally valuable for identity fraud and administrative impersonation across French financial and legal systems.

Full text

Dark Web Informer - Cyber Threat Intelligence France's National ID Agency ANTS Allegedly Breached, 18 Million Citizen Records With Government-Verified Identities Listed for Sale April 14, 2026 - 5:26:51 PM UTC France Government / National Security Standalone API Access Now Available High-volume threat-intelligence data, automated ingestion endpoints, ransomware feeds, IOC data, and more. View API Unlock Exclusive Cyber Threat Intelligence Powered by DarkWebInformer.com Stay ahead of cyber threats with real-time breach tracking, expert analysis, and high quality evidence - built for security professionals, researchers, journalists, and everyday people who take their privacy seriously. Subscribe Now Quick Facts Date & Time 2026-04-14 17:26:51 UTC Threat Actors EvilDump, ExtaseHunters, Breach3d Victim ANTS (France Titres) Industry Government / National Security Category Data Breach Total Records 18,000,000 Agency Function Secure ID & Legal Titles Severity Critical Price DM for Offers Escrow Middleman Accepted Network Open Web Country France Incident Overview A group of threat actors (EvilDump, ExtaseHunters, and Breach3d) claims to have compromised ANTS (Agence Nationale des Titres Securises), the French government agency responsible for issuing and managing secure identification documents and legal titles. ANTS, now operating under the France Titres brand, handles the production and delivery of passports, national identity cards, driver's licenses, vehicle registration certificates, and other official government documents for French citizens. The actors are listing a database of 18 million records for sale. The sample JSON data confirms the database structure with highly detailed per-record fields: Full Legal Names: First names, up to 5 middle/additional names (prenom1 through prenom5), last names, and usage/maiden names (nomusage). The sample shows records with multiple given names reflecting French naming conventions. Contact Details: Personal email addresses from providers including Orange, Gmail, Hotmail, and custom domains, alongside verified mobile phone numbers. Detailed Birth Data: Exact dates of birth, birth city (naisscommune), birth department (naissdepartement), and birth country (naisspays). Physical Addresses: Street number, street name, postal code, city, commune, and country fields. Many records in the sample show empty address fields, suggesting partial population. Account Metadata: Unique usernames (identifiant, which are internal system IDs), government certification status (certifie: true/false indicating whether the identity has been government-verified), and professional status flags (pro: true/false). Gender and Civil Status: Civil titles (M./Mme) and professional status indicators. The government-verified certification status field is what makes this breach exceptionally dangerous. The "certifie: true" flag means the French government itself has confirmed that identity is authentic. For an attacker, a government-certified identity record is the gold standard for identity fraud because it carries implicit trust across all French administrative, financial, and legal systems. The 18 million record count represents a significant portion of the French adult population (France has approximately 50 million adults), making this one of the largest alleged government identity breaches in European history if confirmed. The post was made by EvilDump and credits ExtaseHunters and Breach3d as collaborators. The sample data shows sequential internal IDs (79000072 through 79000080) suggesting structured database extraction rather than scraping. Compromised Data Categories Full Legal Names (Up to 5 Names) Usage / Maiden Names Email Addresses Verified Mobile Numbers Dates of Birth Birth City & Department Physical Addresses Government Certification Status System Identifiers Gender & Civil Titles Professional Status Flags Image Preview Claim URL Subscriber Access Required The original listing URL and unredacted claim images are available on the Threat Feed and Ransomware Feed for paid subscribers. Subscribe Subscriber Access View the original listing URL and unredacted claim images on the feeds below. Threat Feed Ransomware Feed MITRE ATT&CK Mapping T1190 Exploit Public-Facing Application Targets the French national identity agency's infrastructure to gain access to the citizen identity verification database containing 18 million government-certified records. T1213 Data from Information Repositories Extracts 18 million structured citizen identity records from the ANTS database, including names, birth data, addresses, contact details, and government certification status. T1589.001 Gather Victim Identity: Credentials Harvests government-verified citizen identity records representing a significant portion of the French adult population, with certification flags confirming official identity validation. T1078 Valid Accounts System identifiers (identifiant usernames) and government certification status could be leveraged to impersonate citizens or access connected French government services. T1657 Financial Theft Government-certified identity records are the highest-value identity fraud asset, enabling bank account fraud, credit applications, tax fraud, and administrative impersonation across all French systems. T1567 Exfiltration Over Web Service Advertises the stolen national identity database on public forums with DM-based pricing and middleman/escrow accepted for transactions. Dark Web Informer © 2026 | Cyber Threat IntelligenceDarkWebInformer.com

Entities