{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en"},"incident":{"id":"ants","date":"2026-04-15","year":2026,"org":"France Titres / ANTS","domain":"ants.gouv.fr","kind":"government","sector":"Identity / public services","sectorLabel":"Identity / public services","severity":"critical","status":"confirmed","affected":11700000,"affectedLabel":"About 11.7 million accounts that may be concerned","data":"Login identifier, title, names, email, date of birth and unique account ID; sometimes postal address, place of birth and phone.","method":"Official cause still under investigation.","risk":"Government-themed identity phishing around licences, passports and ID documents.","confidence":"Official update; origin still under investigation","sourceName":"France Titres (ANTS)","sourceId":"ants","sourceUrl":"https://mairie.ants.gouv.fr/toute-l-actualite/incident-de-securite-relatif-au-portail-antsgouvfr-point-detape-du-21-avril-2026","sourceIds":["ants","antsInterior","antsTf1Maintenance","antsLemonde","antsLemondeArrest","antsTf1Breach3d"],"lastResearched":"2026-08-16","url":"/incident/ants","detail":{"lead":"France Titres, also known as ANTS, detected a security incident on 15 April 2026 involving the ants.gouv.fr portal. The 21 April official update said about 11.7 million individual and professional accounts could be concerned.\n\nThat figure is phrased as accounts that may be concerned. It should not automatically be read as 11.7 million complete records definitely downloaded. Criminal claims of roughly 18 to 19 million records are not the official count.","timeline":[{"date":"2026-04-15","label":"ANTS detects the security incident."},{"date":"2026-04-16","label":"ANTS reports to the Paris prosecutor that data presented as coming from the incident is being offered for sale. A cyber investigation begins."},{"date":"2026-04-21","label":"Official update: 11.7 million accounts may be concerned. Technical investigation of origin and scope is still ongoing."},{"date":"2026-04-24","label":"ANTS places the portal into maintenance from 19:30 to continue security strengthening."},{"date":"2026-04-25","label":"A 15-year-old suspect is arrested."},{"date":"2026-04-30","label":"Paris prosecutor publicly announces the arrest and says the minor is suspected of having contributed to the leak."}],"how":"The principal ANTS update does not name an initial-access vector or vulnerability. It says internal technical investigations are working to establish origin and scope. Later journalism described an IDOR-style API weakness; researchers also said they had previously reported security flaws. Those accounts remain reporting unless France Titres, investigators or a judicial record confirms the specific technical path.","taken":"Potentially affected fields include login identifier, civil-status title, surname and given names, email, date of birth and a unique account ID. For some accounts the dataset also includes postal address, place of birth and phone number. ANTS said the disclosed fields by themselves did not allow someone to log into the named ANTS account.","notTaken":"At the 21 April stage, ANTS excluded supporting documents uploaded for administrative procedures and biometric data. Passwords were not listed among the disclosed fields.","impact":"The data is highly suitable for government-themed identity phishing. A fraudster can cite a real date of birth, address or ANTS context and impersonate a driving-licence, passport, registration or identity-document process. The main direct danger is not that the leaked fields themselves unlock the portal, but that they make the next social-engineering step more convincing.","response":"ANTS notified CNIL, referred the matter to the Paris prosecutor, and an OFAC investigation was opened. The Interior Minister asked the Inspection générale de l’administration to establish the chain of responsibility. Professional and individual users were informed. ANTS advised password changes at the next login as a precaution. The portal was later placed in maintenance for additional hardening.","methodDisclosure":"undisclosed","attackerClaim":"Sellers on criminal forums claimed a larger dataset, generally in the 18 to 19 million-record range. Official government communications used 11.7 million accounts as the potential scope. The later arrest of a minor suspected of contributing to the leak does not validate the advertised volume.","revision":"A 15-year-old was arrested on 25 April. On 30 April the Paris prosecutor said the minor was suspected of having contributed to the data leak. A government information page that mistakenly referred to detection on 15 March is not used here: primary ANTS and Interior Ministry material consistently says 15 April.","quotes":[{"text":"11.7 million accounts may be concerned","original":"11,7 millions de comptes seraient concernés","originalLang":"fr","attribution":"France Titres / Interior Ministry, 21 April 2026","sourceId":"ants"},{"text":"internal technical investigations","original":"investigations techniques internes","originalLang":"fr","attribution":"France Titres, 21 April 2026","sourceId":"ants"}]}},"source":{"id":"ants","name":"France Titres / ANTS - April 2026 incident update","url":"https://mairie.ants.gouv.fr/toute-l-actualite/incident-de-securite-relatif-au-portail-antsgouvfr-point-detape-du-21-avril-2026","publisher":"France Titres / ANTS","kind":"primary","published":"2026-04-21"},"sources":[{"id":"ants","name":"France Titres / ANTS - April 2026 incident update","url":"https://mairie.ants.gouv.fr/toute-l-actualite/incident-de-securite-relatif-au-portail-antsgouvfr-point-detape-du-21-avril-2026","publisher":"France Titres / ANTS","kind":"primary","published":"2026-04-21"},{"id":"antsInterior","name":"Interior Ministry — ANTS portal incident update","url":"https://www.interieur.gouv.fr/actualites/communiques-de-presse/point-detape-du-21-avril-2026-concernant-lincident-de-securite-relatif-au-portail-antsgouvfr","publisher":"Ministry of the Interior","kind":"primary","published":"2026-04-21"},{"id":"antsTf1Maintenance","name":"TF1 Info — ANTS portal closed for maintenance","url":"https://www.tf1info.fr/justice-faits-divers/piratage-massif-de-l-ants-agence-nationale-titres-securises-le-portail-ferme-des-ce-vendredi-24-avril-pour-maintenance-2438027.html","publisher":"TF1 Info","kind":"secondary","published":"2026-04-24"},{"id":"antsLemonde","name":"Le Monde — what is known about the ANTS leak","url":"https://www.lemonde.fr/pixels/article/2026/04/22/fuite-de-donnees-a-l-ants-site-qui-gere-les-demandes-de-pieces-d-identite-ce-que-l-on-sait_6682414_4408996.html","publisher":"Le Monde","kind":"secondary","published":"2026-04-22"},{"id":"antsLemondeArrest","name":"Le Monde — 15-year-old arrested over the ANTS leak","url":"https://www.lemonde.fr/pixels/article/2026/04/30/piratage-de-l-ants-un-mineur-de-15-ans-interpelle_6684591_4408996.html","publisher":"Le Monde","kind":"secondary","published":"2026-04-30"},{"id":"antsTf1Breach3d","name":"TF1 Info — prosecutor statement on the ANTS arrest","url":"https://www.tf1info.fr/justice-faits-divers/piratage-de-l-ants-ce-que-l-on-sait-de-breach3d-l-adolescent-de-15-ans-place-en-garde-a-vue-2439078.html","publisher":"TF1 Info","kind":"secondary","published":"2026-04-30"}]}