On April 15, 2026, the Agence nationale des titres sécurisés (ANTS), the French government agency that operates the national identity document portal known as France Titres, confirmed a significant breach of its citizen-facing platform. An attacker exploited an Insecure Direct Object Reference (IDOR) flaw in the agency's API to enumerate and extract personal records belonging to both individual and professional account holders. A threat actor using the alias "breach3d" claimed responsibility and advertised a dataset said to contain up to 19 million records for sale on criminal forums. French authorities have notified affected users, regulators, and law enforcement, and investigations into the full scope remain ongoing.
What Happened
ANTS detected the intrusion on April 15, 2026, after a threat actor began offering stolen citizen data for sale. The breach did not involve malware, phishing, or credential stuffing. Instead, the attacker abused a logic flaw in the ANTS API: by manipulating identifier parameters in otherwise legitimate requests, they were able to walk through user records sequentially and pull back data belonging to accounts they had no authorization to access.
The actor, "breach3d," publicly characterized the vulnerability as "elementary" and "really stupid," underscoring that no advanced tooling was required. The flaw reflected a missing authorization check on a sensitive endpoint, meaning the server returned other users' records simply because the request was well-formed, never verifying that the requester owned the object being retrieved. The agency has since implemented additional security measures and notified the relevant data protection and law enforcement bodies.
What Was Taken
The exposed data spans a comprehensive personal profile for each affected account. Compromised fields include full names, email addresses, dates and places of birth, login credentials, unique account identifiers, postal addresses, and phone numbers. In some cases gender and civil status were also exposed. Both individual citizen accounts and professional user accounts were affected.
Critically, uploaded documents such as scanned identity cards and proof-of-address files were not compromised, which limits the immediate risk of full document forgery. However, the breadth of exposed identity attributes is severe. Date and place of birth are permanent, immutable identifiers, and when combined with names, contact details, and credentials, they form a durable identity dossier. The actor advertised up to 19 million records, a figure that, if accurate, would represent a substantial fraction of the French adult population.
Why It Matters
This incident is a textbook demonstration that a "simple" vulnerability can produce one of the most consequential data exposures a nation can face. Unlike a leaked password, which can be reset, the compromised data here is largely permanent. Citizens cannot change their date or place of birth, and the linkage between these attributes and official identity records makes the dataset a long-lived resource for fraud.
For defenders, the strategic lesson is that authorization logic, not perimeter defense, was the single point of failure. The most immediate threats are highly convincing targeted phishing campaigns, since attackers can reference accurate personal details to impersonate ANTS or other government services, and long-term identity fraud, where the data underpins fraudulent document applications, account takeovers, and social engineering against banks and telecoms. A government identity portal is also a high-value target for intelligence and influence operations, raising the stakes beyond ordinary cybercrime.
The Attack Technique
The breach stemmed from an Insecure Direct Object Reference vulnerability, a class of flaw ranked among the OWASP Top 10 web application risks. IDOR occurs when an application exposes a reference to an internal object, such as a record ID, and serves that object based on user-supplied input without confirming the requester is authorized to view it.
In the ANTS case, the API accepted parameters that mapped directly to user records. By incrementing or substituting those identifiers, the attacker enumerated accounts one after another and harvested their contents at scale. No authentication bypass exploit, malware, or zero-day was needed; the endpoint itself failed to enforce object-level access control. This is the same failure mode as OWASP API Security's "Broken Object Level Authorization," and it is dangerous precisely because it is invisible to network and signature-based defenses. The traffic looks like ordinary API usage.
What Organizations Should Do
- Enforce object-level authorization on every endpoint. For each request that returns a record, verify server-side that the authenticated user owns or is permitted to access that specific object. Never rely on the client to scope its own requests.
- Replace sequential or predictable identifiers with unguessable values such as UUIDs, and treat this as defense in depth rather than a substitute for authorization checks.
- Add anomaly detection and rate limiting to API gateways to flag enumeration patterns, such as a single account walking through large ranges of record IDs in a short window.
- Conduct targeted IDOR and Broken Object Level Authorization testing in security reviews, including automated authorization fuzzing across roles and tenants, not just authentication testing.
- Audit logging for sensitive record access so that bulk extraction can be detected and reconstructed quickly during incident response.
- For organizations handling French citizens, treat the exposed fields as compromised: harden phishing-resistant verification, brief support teams against social engineering that cites accurate personal data, and monitor for fraudulent applications referencing these identities.