France Titres (ANTS) Data Breach Exposes 11.7 Million Citizen Accounts
France Titres (Agence nationale des titres sécurisés - ANTS), the French government's identity document portal, detected a security breach on April 15, 2026. The incident exposed personal data from individual and professional accounts, including names, email addresses, dates of birth, postal addresses, phone numbers, login IDs, and unique account identifiers. A threat actor using 'breach3d' claimed responsibility and advertised up to 19 million records, with the agency confirming 11.7 million affected accounts.
Signal context
First seen: Apr 15, 2026
Last updated: Jun 20, 2026
Status: Public signal
Key points
- Breach detected on April 15, 2026.
- 11.7 million accounts confirmed affected (up to 19 million claimed).
- Exposed data included names, email addresses, dates of birth, postal addresses, phone numbers, login IDs, and unique account identifiers.
Signal analysis
BetaThis analysis groups the signal by industry, likely incident action and impacted security area. It helps compare this signal with other published signals without treating the labels as final determinations.
Sector: Public Administration
Likely country: 🇫🇷 France
inferred from company domain
Watch internet-facing systems, credential abuse and exploit activity.
- Source type: outside the affected organization
Impact area: Confidentiality
Likely asset: User or customer data
- 1 signal in the same sector
- 31 signals with the same likely impact area
- 1 signal linked to this organization/domain
External sources
Related signals
Grouped by why the signal is relevant.
Paywall Bypass Vulnerability
Tweakers.net has identified a vulnerability that allows for the bypass of its paywall. This issue is listed as a 'Known issue' within their bug bounty program, indicating that the company is aware of the flaw and is seeking ethical hackers to report findings related to it. A successful bypass could allow unauthorized access to premium content.
Oracle Affected by FortiBleed Campaign
Oracle was identified as one of over 22,000 corporate domains affected by the FortiBleed campaign. A Russian-speaking criminal group compromised Fortinet firewall and VPN devices globally, exfiltrating credentials and potentially gaining full network access.
Horizon Family Medical Group Data Breach
Reports emerged on June 18, 2026, of a possible data breach at Horizon Family Medical Group, a medical provider in New York's Hudson Valley region. Threat actor Incransom claimed to have stolen 7 TB of data, including medical information such as diagnoses, prescriptions, treatments, and lab results.
Council of Europe Hacked by ShinyHunters, 297 GB of Data Stolen
The notorious extortion group ShinyHunters claimed to have hacked the Council of Europe, stealing nearly 300 gigabytes of data, including employee personal information, payroll data, CVs, and medical records. The group threatened to leak the data if negotiations were not initiated.
American Express Insider Data Breach Reported
American Express was involved in an insider data breach where an employee accessed the personal financial information of an individual. An investigation by the Australian Privacy Commissioner found the company breached privacy laws by failing to implement adequate restrictions on staff access to customer accounts.
Active Exploitation of Multiple Critical FortiSandbox Vulnerabilities
Threat actors are actively exploiting multiple critical vulnerabilities in Fortinet FortiSandbox products, including CVE-2026-39813 (path traversal), CVE-2026-39808 (OS command injection), and CVE-2026-25089 (OS command injection). These flaws could allow unauthenticated attackers to bypass authentication, execute unauthorized code or commands, and escalate privileges. Fortinet released patches for these vulnerabilities in April and June 2026. Exploitation has been observed from multiple sources across various countries.