Teen Detained After Hacking French Government Agency

French police have arrested a 15-year-old in connection with a massive data breach at the state employment agency, which could affect tens of millions of people and has become one of the most high-profile cases in recent memory.

French authorities have arrested a 15-year-old who they suspect of selling information that he stole from a cyber-attack on France Titre’s (also known as ANTS) computer systems. France Titres handles administrative documentation.

France Titres has confirmed that there was in fact a breach and that the data that “breach3d” had posted for sale on a cyber-crime forum were legitimate.

France Titres reported suspicious activity on its internal network at about 6 pm local time on April 13. Three days later, on April 16, the Paris prosecutor received notification of the breach. An official criminal investigation then ensued.

Prosecutors think that the teenage detainee created the “breach3d” identity. Prosecutors also estimate that the teen sold around 12 million to 18 million records that he got through his hacking. However, “breach3d” claims to have gotten access to 19 million records.

He is charged with unlawful access to the national computer-based system for managing citizen’s personal data; saving and stealing information; and with using specific programs to commit similar offenses.

According to the Parisian prosecutor’s office, the penalties allowed for by these laws could be as much as seven years imprisonment plus a fine of €300,000.

This matter was turned over to an examining magistrate. The prosecution has formally charged him. The prosecutors are asking for the court to exercise control (judicial supervision) over the suspect.

ANTs says that he accessed account information — including both private and business accounts — through his account on the ants.gouv.fr portal.

Included in the stolen data were:

• Full name

• Email address

• Birthdate

• Mailing Address

• Telephone Number

Initially there had been reports that as many as 19 million accounts may have been compromised. ANTs later said approximately 11.7 million accounts had indeed been compromised. But also that none of the compromised information would allow unauthorized access to the accounts.

The investigating judge will make a final determination, but at this point the teen remains in custody without sentencing, and it appears that the matter will continue.