France investigates 15-year-old over alleged hack of national ID agency

A teenage hacker is suspected of breaching a French government agency responsible for identity documents and attempting to sell millions of citizens’ personal data, Paris prosecutors said on Thursday.

The minor was taken into police custody on April 25 on suspicion of involvement in a data breach affecting the National Agency for Secure Documents (ANTS), which processes applications for passports, national identity cards, residence permits and driver’s licenses.

French authorities did not reveal the suspect’s identity but said he may have operated online under the pseudonym “breach3d,” an alias used to advertise between 12 million and 18 million records for sale on cybercriminal forums earlier this month.

The cybercrime unit of the Paris prosecutor’s office was alerted to the ANTS intrusion last month after the data appeared on underground marketplaces. The agency later confirmed unusual activity on its network and acknowledged that the information being circulated appeared authentic.

Authorities opened an investigation into fraudulent access to and extraction of data from a state-run automated personal data processing system — offenses that carry penalties of up to seven years in prison and a €300,000 ($350,000) fine under French law.

Earlier this week, prosecutors requested that the minor be formally charged and placed under judicial supervision. Authorities allege the suspect was involved in a wide range of activities linked to attacks on the state system, including unauthorized access, maintaining access, extracting and transmitting data, and possessing tools designed to carry out cyber intrusions.

ANTS manages one of France’s most sensitive digital platforms, handling applications for passports, national identity cards and driver’s licenses. The agency also oversees a new government age-verification app intended to prevent children under 15 from accessing social networks.

French officials disclosed last week that the cyberattack may have exposed multiple categories of personal data tied to user accounts.

Potentially compromised information includes login credentials, names, email addresses, birth dates and unique account identifiers. Authorities said additional personal details — including postal addresses, phone numbers and places of birth — may also have been affected.

The incident comes amid a string of high-profile data breach investigations in France.

Earlier this month, authorities arrested a 20-year-old suspect known online as “HexDex,” believed to be responsible for dozens of intrusions targeting public institutions, sports federations and private organizations.

In January, police also detained an 18-year-old accused of leaking and selling the personal data of more than one million members of the French Shooting Federation.