France Titres — the French government agency responsible for managing national identity documents including passports, driving licences, and national ID cards — confirmed a data breach on approximately April 22 2026 affecting 11.7 million citizens. The intrusion was detected on approximately April 15. Threat actor ‘breach3d’ claimed to have exfiltrated up to 19 million records; France Titres confirmed the 11.7 million figure following internal forensic investigation.
What Was Stolen
Confirmed stolen records include: full names, dates of birth, places of birth, postal addresses, email addresses, and phone numbers. The agency confirmed that document image data, biometric data, and financial information were not stored in the compromised database — though this has not been independently verified.
The specific combination of name, birth date, address, email, and phone represents a high-value identity fraud package. These are precisely the fields used for knowledge-based authentication at financial institutions, telecoms, and online services, and for verifying identity in social engineering attacks against corporate help desks.
Regulatory Response
France Titres notified the CNIL (Commission Nationale de l’Informatique et des Libertés) under GDPR Article 33, which requires supervisory authority notification within 72 hours of awareness. ANSSI (Agence Nationale de la Sécurité des Systèmes d’Information) was engaged given France Titres’ status as an operator of critical national infrastructure, and the Paris Public Prosecutor opened a preliminary investigation.
Affected individuals are not being individually notified at this stage pending the completion of forensic investigation — a decision that may face scrutiny under GDPR Article 34, which requires notification to affected individuals when a breach is “likely to result in a high risk” to their rights and freedoms. A database containing the identity particulars of one in five French residents almost certainly meets that threshold.
Why It Matters
France Titres issues the documents French citizens use to verify their identity for government services, bank account opening, mortgage applications, and major financial transactions. The compromised data enables:
- Account takeover at any service using name, DOB, address, or email for account recovery or identity verification
- Fraudulent account opening at financial institutions using the stolen identity particulars
- Highly targeted phishing and vishing — attackers now hold enough personal detail to impersonate France Titres itself, the CNIL, or any service the victim uses that has their email and phone number
- Identity fraud enabling further attacks — compromised French nationals may be used as mules or unwitting participants in financial fraud
Threat actor breach3d has previously monetised stolen datasets through underground criminal marketplace sales. If this dataset enters criminal markets, the exploitation window extends for years.
Recommended Actions
- Raise social engineering alert levels for employees and customers in France — this dataset enables convincing targeted attacks combining full identity detail with public knowledge of the breach.
- Review knowledge-based authentication (KBA) controls for French customer accounts — name, DOB, and address are now compromised factors for millions of individuals.
- Strengthen out-of-band authentication for sensitive account transactions involving French customer accounts: SMS one-time passwords sent to the registered phone number remain viable only if combined with a second factor, given that phone numbers are in the compromised dataset.
- Monitor for fraudulent account applications from new customers citing French identity documents — cross-reference against expected customer patterns.
- Watch CNIL guidance closely — if CNIL mandates individual notification under Article 34, downstream organisations should expect increased customer security enquiries and may need to issue proactive guidance to French customers.
Share this article