Security breach concerning the ants.gouv.fr portal

Subject to ongoing investigations, as regards personal accounts, the personal data in question would appear to be personal identification data:

• login credentials,
• civil status, first names, last name,
• email address,
• date of birth,
• single-use login credentials,
• and, where the case may be, other data that is not systematically included in the accounts: postal address, place of birth, phone number.

The users impacted are currently being informed individually.

The disclosure of data does not apply to additional data provided when carrying out administrative procedures, such as attached documents. This personal data does not enable any unauthorized access to the portal account.

Pursuant to Article 33 of the European General Data Protection Regulation (GDPR), the breach was reported to the CNIL (French Data Protection Authority) and a report was addressed to the Public Prosecutor in Paris pursuant to Article 40 of the French Penal Code for the purpose of initiating an investigation. The French National Cybersecurity Agency (ANSSI) was also informed.
 

Technical investigations, initiated as soon as the breach was discovered, are currently under way. They are carried out by France Titres (ANTS) teams and competent departments. They aim to determine the exact origin and impact of the breach.

Measures have been rolled out to reinforce security to ensure the continuity of portal services and the protection of data.

No action is required from users. Nonetheless, we advise them to exercise the utmost caution when receiving any suspicious or unusual messages in the future (SMS, phone calls, emails, etc.) that appear to come from France Titres (ANTS).

Please note that any offer to sell or disseminate data presented as that of France Titres (ANTS) is an offence.