15-year-old hacker arrested over massive French government data leak

French authorities have detained a 15-year-old individual over suspicion of hacking into the systems of the National Agency for Secure Documents and stealing between 12 to 18 million lines of data.

 

The Paris Public Prosecutor’s Office said in a press release that the 15-year-old minor was taken into custody on April 25 after investigations revealed that the minor hacked into the government agency’s personal data processing system, stole millions of lines of data and put up the data for sale on the dark web.

 

The arrest followed an announcement by the Agence Nationale Des Titres Securises, or the French government’s National Agency for Secure Documents, that on April 15, it discovered that a cyber attack had resulted in the compromise of government employees’ personal information and login IDs required to access its official portal.

 

The agency said that the compromised information included login IDs, full names and titles, email addresses, dates of birth, unique account identifiers, postal addresses, places of birth and telephone numbers. The agency did not disclose the number of compromised individuals but stressed that the compromised information cannot be used by malicious actors to gain access to the government portal.

 

The National Agency for Secure Documents is a public administrative establishment supervised by the Ministry of the Interior. Headquartered in Charleville-Mézières, the agency is responsible for issuing secure documents such as vehicle registration certificates, national identity cards, residence permits, biometric passports, and travel documents for refugees and stateless persons.

 

According to the Paris Public Prosecutor’s Office, ANTS informed it about the cyber incident on April 16, and the investigation that followed quickly determined that the minor had gained access to the agency’s data processing system, stole millions of lines of data and used the pseudonym "breach3d" to try and sell the stolen data on the dark web.

 

The Office said that the gravity of the crime merits a punishment of up to seven years in prison and a fine of €300,000. It has recommended that the minor be placed under judicial supervision pending the commencement of a formal trial.

 

"A formal judicial inquiry was opened by the Paris Public Prosecutor’s Office on April 29, 2026. The Public Prosecutor requested that the minor be formally charged and placed under judicial supervision in connection with these acts, which constitute offenses involving unauthorized interference with—specifically: access, continued presence, extraction, transmission, possession, and obstruction of operation—an automated personal data processing system operated by the State, as well as the possession of equipment or software designed to facilitate such interference. The investigation is now proceeding under the direction of an investigating judge," it said.