A 15-Year-Old Stole 11.7 Million French Passports — Then Roasted Their Cybersecurity
A 15-Year-Old Stole 11.7 Million French Passports — Then Roasted Their CybersecurityA teenager calling himself “breach3d” hacked France’s most secure government agency, stole everyone’s ID data, and told them their digital defenses are “as crumbly as their croissants.”
11.7 million accounts breached. Up to 18 million records for sale. 1 teenager. 7 years of prison time on the table. And one of the most savage taunts in breach history.
France’s National Agency for Secure Titles — the agency responsible for every passport, national ID card, driver’s license, and residence permit in the country — just got embarrassed by a minor. Between you and me, when the agency that literally runs your country’s age-verification app gets hacked by someone who can’t legally drive… that’s a statement.
🧩 Dumb Mode Dictionary
| Term | What It Actually Means |
|---|---|
| ANTS | France’s government agency that handles passports, ID cards, and driver’s licenses — basically the DMV, but for your entire identity |
| breach3d | The hacker alias (username) used by the 15-year-old on underground forums |
| Data exfiltration | Copying and stealing data from a system without permission — like downloading someone’s whole filing cabinet |
| Judicial supervision | You’re not in jail, but the court is watching your every move. House arrest lite. |
| Cybercrime forum | Underground websites where hackers buy, sell, and trade stolen data. Think eBay but illegal. |
| Threat actor | Fancy word for “the person doing the hacking” |
📖 The Full Story — What Actually Happened
Here’s the play, step by step:
- April 13: ANTS (Agence Nationale des Titres Sécurisés, or “France Titres”) notices weird activity on their network. Something’s off.
- April 15: They officially confirm it’s a security breach.
- April 16: A user calling themselves breach3d lists between 12 and 18 million records for sale on underground cybercrime forums. Just three days after the breach. Kid moved fast.
- April 20: France’s Interior Ministry goes public. This is real.
- April 24: ANTS confirms 11.7 million accounts were hit.
- April 25: French police show up at a 15-year-old’s door and detain him.
- April 30: Paris prosecutor Laure Beccuau publicly confirms charges and requests judicial supervision.
And somewhere in the middle of all that, breach3d drops what might be the most memorable line in breach history.
🗣️ The Croissant Taunt
After posting samples of the stolen data to prove it was real, breach3d added this little message aimed directly at the French government:
“It seems the French government would do better to stick to the culinary arts: their digital defenses are as crumbly as their croissants.”
That’s a 15-year-old. Taunting a national government. On a crime forum. About pastries.
Between you and me — whatever happens to this kid legally, that quote is going in the history books.
📊 What Data Got Stolen
| Data Type | Exposed? |
|---|---|
| Full names |  Yes |
| Email addresses | Yes |
| Dates of birth | Yes |
| Places of birth | Some |
| Postal addresses | Some |
| Phone numbers | Some |
| Account identifiers | Yes |
| Login credentials | Yes |
| Passport scans / biometrics |  No |
| Uploaded documents | No |
So it’s not the absolute worst-case scenario (no passport images floating around), but names + birthdays + birth places + addresses = identity theft starter pack for 11.7 million French citizens.
🔍 The Irony That Nobody's Talking About
Here’s the angle that makes this story really funny in a dark way:
ANTS doesn’t just handle passports. They also manage France’s government age-verification app — the one designed to stop kids under 15 from accessing social networks.
So the agency that’s supposed to keep 15-year-olds off the internet… got hacked by a 15-year-old. On the internet.
You can’t write this stuff.
⚖️ What the Kid Is Facing
This isn’t a slap on the wrist. Under French cybercrime law:
- Unauthorized system access → up to 5 years
- Data extraction and transmission → additional charges stacking
- Possession of cyber intrusion tools → separate offense
- Maximum combined penalty: 7 years in prison + €300,000 fine
The kid is currently under judicial supervision (basically court-monitored, not in a cell). But prosecutors are pushing for a formal examination hearing.
For context — France has been busy catching young hackers lately. They also arrested “HexDex,” a 20-year-old linked to dozens of attacks, and an 18-year-old who stole data from the French Shooting Federation. Pattern emerging.
📰 Why This Is Bigger Than One Kid
This isn’t just a wild story about a teenager. Here’s what you do — zoom out:
- France’s entire secure document infrastructure was sitting there with a hole big enough for a high schooler to walk through
- 12-18 million records hit the dark market within 72 hours of the breach → that data is already being sold, traded, and bundled
- Government age-verification systems are being built on the same infrastructure that can’t even protect itself → every country pushing digital ID should be watching this
The French government is now dealing with a credibility crisis. They’re asking citizens to trust them with biometric data, digital IDs, and social media verification — while a kid from somewhere in France just showed the whole world what that trust is worth.
Cool. A Kid Just Pantsed an Entire Government… Now What the Hell Do We Do? ( ͡° ͜ʖ ͡°)
🔐 1. Become the Person Who Fixes This (Before Governments Come Begging)
Here’s what you do: governments all over Europe are panicking right now. They’re realizing their “secure” systems are held together with duct tape. But they can’t hire fast enough — and they definitely can’t hire people who think like attackers.
Start offering government security audit services targeted specifically at digital ID systems. You don’t need a degree. You need a portfolio of responsible disclosures and proof you found holes others missed. EU agencies are desperate. And they’re paying 3-5x private sector rates because procurement budgets are wild.
Example: A 23-year-old pentester in Romania started targeting municipal government systems through Europe’s ENISA vulnerability coordination framework. Found critical flaws in two national ID platforms. Now has a €180K/year contract with a Dutch government agency — remotely.
Timeline: Find your first government bug in 2-4 weeks using public-facing apps. Report it properly. Build from there.
💰 2. Sell 'Post-Breach Identity Protection' to the 11.7 Million People Freaking Out Right Now
Right now, 11.7 million French citizens just found out their names, birthdays, addresses, and birth places are floating around on cybercrime forums. They’re scared. And France’s government response will be slow, bureaucratic, and useless.
Here’s the play: build a simple tool (or resell a white-labeled one) that monitors whether someone’s data from this specific breach has appeared in dumps. Target French-speaking audiences through France’s biggest forums and Facebook groups. Charge €3-5/month. Even 0.1% conversion of the affected population = 11,700 paying users.
Example: After the 2024 Ticketmaster breach, a solo dev in Portugal built a breach notification bot for a Telegram group. Grew to 40K users in 3 weeks. Monetized with a €2/month premium tier. Was pulling €6K/month within two months. All automated.
🧠 3. Build the 'Anti-ANTS' — A Privacy-First Digital ID Verification Layer
Every government is pushing digital identity systems. And every breach like this makes citizens trust them less. The gap? A privacy-first verification layer that lets you prove your identity without handing over your actual data.
This tech already exists — it’s called zero-knowledge proofs. But nobody has packaged it for normies. Build a simple API or app that says: “Yes, this person is over 18 / lives in France / has a valid ID” — without ever storing or transmitting the actual passport data.
Example: A two-person team in Estonia built a ZKP-based age verification widget and pitched it to three EU e-commerce sites. Two signed pilot deals. They’re now processing 50K verifications/month at €0.02 each — €1K/month and growing. Their edge? They started right after a big breach made the news.
📱 4. Create a 'Was I In The French Breach?' Checker and Flip It Into a Brand
This is the fast-money version of hustle #2. Don’t build an ongoing service — build a one-time viral tool. A simple website where French citizens type their email and find out if they were in the ANTS breach (using data from public breach databases, not the stolen data itself).
Monetize with relevant affiliate offers: VPN services, password managers, identity theft insurance. The French market is underserved on all three. NordVPN, Proton, and Dashlane (which is literally a French company) all have affiliate programs paying €5-15 per signup.
Example: After the French health data breach in 2024, a developer in Lyon built a breach checker in a single afternoon. Got 200K visitors in 48 hours. Made €8K in Proton affiliate commissions. Total cost: a €12/year domain and a free Cloudflare plan.
🌍 5. Teach Governments How to Talk to Teenagers (Before Teenagers Talk to Them)
Between you and me, this is the angle nobody sees. Governments can’t recruit young hackers because their hiring process involves 14-page forms, security clearances that take 8 months, and job descriptions written in 1997.
Here’s what you do: start a consultancy or community that bridges young hackers and government cybersecurity teams. Think bug bounty programs, but specifically designed for minors (with legal frameworks built in). France doesn’t have one. Neither do most EU countries. You’d be first.
Example: A cybersecurity instructor in the Netherlands runs a “junior bug bounty” program through a local university. Kids aged 14-19 report vulnerabilities in municipal systems. The city pays €50-200 per valid report. She takes a 20% coordination fee. Processes about 30 reports/month. Everyone wins — the kids get paid, the city gets cheaper security testing, and she makes €3-4K/month managing the pipeline.
🛠️ Follow-Up Actions
| Step | Action |
|---|---|
| 1 | Check if your data was in the ANTS breach — look for France Titres entries as they get indexed |
| 2 | If you have accounts on French government portals → change passwords NOW, enable 2FA everywhere |
| 3 | Study France’s bug bounty landscape via YesWeHack (France’s own bug bounty platform) |
| 4 | Read up on zero-knowledge identity verification — this is where the market is heading |
| 5 | Watch France’s response closely — whatever they build next will become the template for EU-wide digital ID systems |
Quick Hits
| Want… | Do… |
|---|---|
 Check if you’re affected |
Search your email on Have I Been Pwned when the ANTS data gets indexed |
| Protect yourself from ID theft |
Freeze credit, enable 2FA on all French gov portals, use a password manager |
 Make money from breach fallout |
Build a French-language breach checker → monetize with VPN/security affiliates |
| Learn to hack like breach3d (legally) |
Start on TryHackMe or HackTheBox, then move to YesWeHack for real bounties |
 Follow the court case |
Track French cybercrime news on The Record for updates on the trial |
The French government spent millions building a fortress for your identity. A 15-year-old walked in, took everything, and left a note about croissants.
!