19 million records from the French Secure ID Agency (ANTS) were put up for sale online in April. The ANTS then had to admit to a break-in into its system. After all, it didn’t take long until a suspect was taken into police custody: a 15-year-old boy is officially suspected of having contributed to the illegal data acquisition. He faces up to seven years in prison and a fine of up to 300,000 euros.
Read more after the ad
The Paris public prosecutor’s office announced this on Thursday. An investigating judge is now looking into the case. The underage suspect is said to be behind the pseudonym breach3d under which the data set was offered for sale online. According to an announcement from the ID authority ANTS on April 21, the stolen data sets contain username, title, first and last name, email address, date of birth, account number and, for some of the accounts, additional postal address, place of birth and telephone number. The office has confirmed the authenticity of the data sets offered for sale.
It’s embarrassing
The ANTS (Agence Nationale des titres securisés) is also known as France Titre. It is a department of the French Ministry of the Interior. It is responsible for issuing passports, identity cards, as well as driving licenses for road vehicles and motor boats, as well as documents for the registration of motor vehicles, residence permits, visas and a number of other ID cards and documents for stays and border crossings. However, the papers are printed by the state printing company (Imprimerie Nationale).
If it were actually not well-equipped enemy spies or other organized criminals who were behind the incident, but rather a single teenager, it would not be a credit to the French Interior Ministry. Neither ANTS nor the public prosecutor say how the illegitimate access to the database was achieved.
If the ANTS speaks of 11.7 million data records, the public prosecutor’s office states twelve to 18 million. It is unclear when the perpetrator broke into the database or when this was noticed. Initially it was said that the incident was discovered on April 15th, but the official information currently states March 15th. The public prosecutor’s office mentions April 13th, but the complaint was only filed on April 16th. The publication to warn those affected took place on April 22nd.
Read more after the ad
(ds)
