Massive Breach of France Titres Exposes 11.7 Million Citizen Records

www.decryptiondigest.com

Massive Breach of France Titres Exposes 11.7 Million Citizen Records

First seen 9 Jun 2026, 14:29 UTC • •68.0

Article Content

1 / 6

Browse articles

ThreatCluster •June 10, 2026 at 14:23 UTC

•11.7 million citizen records compromised due to an IDOR vulnerability in the ANTS API.
•Threat actors are selling the dataset on dark web forums, increasing risks of identity fraud.
•The breach affects both individual and professional accounts, with government-verified identity data.

On April 24, 2026, France Titres confirmed a breach of its identity portal, compromising 11.7 million citizen accounts. The breach was attributed to a group of threat actors known as EvilDump, ExtaseHunters, and Breach3d, who claimed to have extracted between 18 and 19 million records. The attack exploited an Insecure Direct Object Reference (IDOR) vulnerability in the ANTS API, allowing unauthorized access to sensitive user data. Affected records include full names, dates of birth, addresses, and unique identifiers, posing significant risks for identity fraud and phishing attacks. The dataset is currently being offered for sale on dark web forums. French authorities, including ANSSI and CNIL, are investigating the breach and have notified affected users. The incident highlights the vulnerabilities in government systems that manage sensitive identity data.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 138d ago How this analysis works

Timeline

2026-04-15

Security breach detected at France Titres

The breach was identified, exposing personal data from millions of user accounts through an IDOR vulnerability.

2026-04-16

Threat actors claim responsibility

A group of threat actors posted on criminal forums, claiming to have access to 18-19 million records for sale.

Dark Web Informer

2026-04-24

France Titres confirms breach

The agency confirmed the breach, revealing the scale of compromised accounts and the nature of the data exposed.

Decryption Digest

More articles in this cluster (5)

Threat Graph

8 entities, 7 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (6)

Data Breach
Phishing
T1078 - Valid Accounts
T1119 - Automated Collection
T1210 - Exploitation Of Remote Services
T1566 - Phishing

Organization (1)

France Titres

Affected Platform (1)

API

Relationships

Data Breach targets API
Phishing targets API
T1078 - Valid Accounts targets API
T1119 - Automated Collection targets API
T1210 - Exploitation Of Remote Services targets API
T1566 - Phishing targets API
Data Breach related to France Titres

Following this threat?

Track France Titres in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…

Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…