French prosecutors link 15-year-old to mega-breach at state’s secure document agency
(2026/04/30)
- Reference: 1777567162
- News link: https://www.theregister.co.uk/2026/04/30/french_gov_mega_breach_suspect/
- Source link:
French prosecutors say police detained a 15-year-old on April 25 over the alleged theft of millions of records from France Titres (ANTS), the agency handling secure documents.
The Paris Prosecutor's Office announced on Thursday that the minor, suspected of using the online alias "breach3d" and not named because French law protects minors, faces two computer crime allegations linked to an intrusion in which between 12 million and 18 million lines of data were offered for sale on cybercrime forums.
It formally opened a judicial investigation on April 29, covering alleged fraudulent access to a state-run automated data processing system and the extraction of data from it.
[1]
Each offense carries a potential prison sentence of seven years and a maximum €300,000 (~$350,000) fine.
[2]
[3]
Public Prosecutor Laure Beccuau has requested that the minor, whose pronouns, like their name, were also not specified, be formally charged and placed under judicial supervision.
Beccuau said that France's office against cybercrime (OFAC) was informed in April of a cyberattack against ANTS, which handles passports, ID cards, and other secure documents, and that ANTS confirmed the reports on April 13.
[4]
The Paris Public Prosecutor's Office was notified three days later and launched an investigation into the case the same day.
Public [5]confirmation of the attack came from the French Interior Ministry on April 20, although it revealed no details about the suspected culprit. French police detained the 15-year-old on April 25, and prosecutors [6]announced [PDF] on Thursday that they were seeking formal charges and judicial supervision.
The seller using the alias "breach3d" initially advertised the data trove as containing 18-19 million records – slightly above the upper range cited by Beccuau on Thursday – and the types of data offered for sale aligned with what the Interior Ministry had described.
[7]France's digital directorate dumping Windows desktops, adopting Linux instead
[8]France buys nuclear supercomputing spinoff Bull from Atos for €404M
[9]French cops free mother and son after 20-hour crypto kidnap ordeal
[10]Mistral boasts code-proofing agent offers champagne performance on a budget bière
These were: login IDs, full names, email addresses, dates of birth, unique account identifiers, postal addresses, and telephone numbers, but not any attachments such as scans or photos.
If the scale claimed by breach3d holds up, and if the records each pertained to unique individuals, this would constitute a breach affecting roughly a third of France's population.
[11]
France's approach to punishing minors via its legal system is typically geared toward re-education and rehabilitation rather than prison time.
While those aged between 13 and 16 can face time in juvenile detention, it is often used as a last resort measure.
The maximum sentences and fines for the charges the 15-year-old in this case faces are upper limits imposed on adult offenders, and would likely be lowered substantially in cases involving a minor, like this one. ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2afPQ_07HnER3IG6ZzpxCPgAAAYY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44afPQ_07HnER3IG6ZzpxCPgAAAYY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33afPQ_07HnER3IG6ZzpxCPgAAAYY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44afPQ_07HnER3IG6ZzpxCPgAAAYY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2026/04/22/frances_secure_id_agency_probes/
[6] https://www.tribunal-de-paris.justice.fr/sites/default/files/2026-04/2026-04-30%20-%20CP%20interpellation%20fuite%20de%20donn%C3%A9es%20ANTS.pdf
[7] https://www.theregister.com/2026/04/13/france_tech_sovereignty_plan/
[8] https://www.theregister.com/2026/04/01/france_bull_purchase/
[9] https://www.theregister.com/2026/04/15/crypto_kidnap_france/
[10] https://www.theregister.com/2026/03/17/mistral_leanstral_ai_code_verification_tool/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33afPQ_07HnER3IG6ZzpxCPgAAAYY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://whitepapers.theregister.com/
The Paris Prosecutor's Office announced on Thursday that the minor, suspected of using the online alias "breach3d" and not named because French law protects minors, faces two computer crime allegations linked to an intrusion in which between 12 million and 18 million lines of data were offered for sale on cybercrime forums.
It formally opened a judicial investigation on April 29, covering alleged fraudulent access to a state-run automated data processing system and the extraction of data from it.
[1]
Each offense carries a potential prison sentence of seven years and a maximum €300,000 (~$350,000) fine.
[2]
[3]
Public Prosecutor Laure Beccuau has requested that the minor, whose pronouns, like their name, were also not specified, be formally charged and placed under judicial supervision.
Beccuau said that France's office against cybercrime (OFAC) was informed in April of a cyberattack against ANTS, which handles passports, ID cards, and other secure documents, and that ANTS confirmed the reports on April 13.
[4]
The Paris Public Prosecutor's Office was notified three days later and launched an investigation into the case the same day.
Public [5]confirmation of the attack came from the French Interior Ministry on April 20, although it revealed no details about the suspected culprit. French police detained the 15-year-old on April 25, and prosecutors [6]announced [PDF] on Thursday that they were seeking formal charges and judicial supervision.
The seller using the alias "breach3d" initially advertised the data trove as containing 18-19 million records – slightly above the upper range cited by Beccuau on Thursday – and the types of data offered for sale aligned with what the Interior Ministry had described.
[7]France's digital directorate dumping Windows desktops, adopting Linux instead
[8]France buys nuclear supercomputing spinoff Bull from Atos for €404M
[9]French cops free mother and son after 20-hour crypto kidnap ordeal
[10]Mistral boasts code-proofing agent offers champagne performance on a budget bière
These were: login IDs, full names, email addresses, dates of birth, unique account identifiers, postal addresses, and telephone numbers, but not any attachments such as scans or photos.
If the scale claimed by breach3d holds up, and if the records each pertained to unique individuals, this would constitute a breach affecting roughly a third of France's population.
[11]
France's approach to punishing minors via its legal system is typically geared toward re-education and rehabilitation rather than prison time.
While those aged between 13 and 16 can face time in juvenile detention, it is often used as a last resort measure.
The maximum sentences and fines for the charges the 15-year-old in this case faces are upper limits imposed on adult offenders, and would likely be lowered substantially in cases involving a minor, like this one. ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2afPQ_07HnER3IG6ZzpxCPgAAAYY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44afPQ_07HnER3IG6ZzpxCPgAAAYY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33afPQ_07HnER3IG6ZzpxCPgAAAYY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44afPQ_07HnER3IG6ZzpxCPgAAAYY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2026/04/22/frances_secure_id_agency_probes/
[6] https://www.tribunal-de-paris.justice.fr/sites/default/files/2026-04/2026-04-30%20-%20CP%20interpellation%20fuite%20de%20donn%C3%A9es%20ANTS.pdf
[7] https://www.theregister.com/2026/04/13/france_tech_sovereignty_plan/
[8] https://www.theregister.com/2026/04/01/france_bull_purchase/
[9] https://www.theregister.com/2026/04/15/crypto_kidnap_france/
[10] https://www.theregister.com/2026/03/17/mistral_leanstral_ai_code_verification_tool/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33afPQ_07HnER3IG6ZzpxCPgAAAYY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://whitepapers.theregister.com/
Yet Another Anonymous coward
re-education and rehabilitation rather than prison time.
Putting him/her/it in charge of IT security for the agency might be a good "community service"
Paul Herber
Re: re-education and rehabilitation rather than prison time.
The ultimate deterrent for a French person - if you do prison time, it's British food, Dutch wine and Norwegian television!!!!
15 year old pwns French identity database
What an obvious failure. They just had to deploy EU digital ID and it would have kept the 15 year old out. Everyone knows your agency can't be pwned by teenagers if your digital ID policy restricts break-ins to verified adults only.