ANTS France
The agency responsible for secure credentials could not say whether the number was 11 million or 18.
What happened?
The Agence Nationale des Titres Sécurisés, the French agency responsible for secure credentials and identity documents, announced that its database had been breached. The figure given covers a range: between 11 and 18 million accounts.
The attacker, the entry method and the dwell time have not been established in the reporting cited here. The range itself is the detail worth dwelling on, because an agency that issues secure credentials published a seven million person margin of error about its own user base.
What data was actually inside?
Names, user IDs, phone numbers and addresses.
No identity document numbers in the published field list, which matters and is worth stating plainly. What the breach does establish is the association: these people hold an account with the national agency for identity documents, which in itself indicates an application for a passport, licence or identity card.
Who gets hurt and how?
French citizens who applied for an official document online, which in practice is most adults. They had no alternative route, because the agency is the single channel for these applications.
A phone number and address paired with a confirmed relationship to the identity documents agency is unusually good phishing material. A message claiming a problem with a document application, sent to the right number, referencing the right address, arrives with the credibility that generic fraud never achieves.
What did they think they were doing right?
Centralising secure credential issuance is sound policy. One agency with one process produces better document security than fragmented regional issuance, and the online channel exists because citizens need it.
The assumption to test is that an agency expert in securing documents is therefore expert in securing the database of people who requested them. Those are different disciplines, and the second one rarely gets the attention the first does.
What did they not know about their own data?
How many accounts existed. The range between 11 and 18 million is not a disagreement between sources, it is the agency's own uncertainty, and that is the inventory failure stated in public.
An organisation that knows its data can count its records. A seven million gap suggests duplicate accounts, inactive accounts, merged systems or archives whose boundaries were never established, which is the normal condition of a system that has run for years without anyone auditing its contents.
The scope of a notification obligation cannot be narrower than the uncertainty about who is in the database.
If your business runs on databases, you probably have similar records, customer data, credentials, financial information. Do you know what's actually in yours?
Not sure where to start? How to find sensitive data across your estate
What does attribution look like the morning after?
No group has been named and no attribution appears in the reporting cited here.
A government identity agency is a plausible target for criminal resale and for state interest alike, and the published field list does not distinguish between them.
What would have changed the outcome?
Knowing the size and shape of the account database, which sounds trivial and evidently was not. The published range is the finding.
Second, retention. An account created to apply for a single document a decade ago does not need to persist indefinitely with a current phone number and address attached, and the difference between 11 and 18 million is probably largely made up of exactly those records.
Gyazo found out the hard way.
Your team could spend the next 6 months rebuilding systems, notifying customers, and answering legal questions. Or you could spend 24 hours finding out what's actually at risk.
Want to understand the process first? Read our guide to sensitive data discovery .