French Teen Arrested for Alleged Sale of Stolen ANTS Data

TL;DR: French authorities arrested a 15‑year‑old suspected of selling 12‑18 million records stolen from the ANTS agency. The teen used the alias ‘breach3d’ to offer the data on a cybercriminal forum.

Context: On April 13, ANTS detected unusual activity on its network and reported it to authorities three days later. The agency confirmed on April 20 that a threat actor had accessed personal data from individual and professional accounts on the ants.gouv.fr portal, including names, emails, dates of birth, addresses, and phone numbers.

Key Facts: Investigators say the suspect offered between 12 and 18 million records for sale, a figure that aligns with ANTS’s later count of 11.7 million impacted accounts. The alleged offenses include unauthorized access, persistence, data exfiltration, and possession of tools used to commit the crimes, which carry a maximum penalty of seven years in prison and a €300,000 fine.

What It Means: The case shows how even a single compromised credential can lead to large‑scale data theft from a government identity service. While ANTS stated the stolen data could not be used for unauthorized access, the exposure of personal details raises privacy concerns and highlights the value of such data on underground markets.

Mitigations: Organizations should enforce multi‑factor authentication for all privileged accounts, monitor for anomalous login patterns using UEBA tools, and segment networks to limit lateral movement. Regularly patching internet‑facing systems and reviewing access controls on data repositories can reduce the risk of initial breach. Deploying data loss prevention (DLP) solutions and monitoring for large file transfers helps detect exfiltration attempts.

What to watch next: The investigating judge’s decision on formal charges and any potential judicial supervision measures for the minor.