French Data Index: 52M Records from ANTS, CAF, SFR and 22 More Breaches

A threat actor known as Addka72424 has compiled a massive database index containing 52,511,569 verified records from 25 separate French datasets, according to dark web forum postings reported by security researchers.

The threat actor describes France as "currently a very leaky country" and has created what they call a "temporary unofficial index" of leaked French databases. All datasets are claimed to be verified, backed up, and downloadable after unlocking with forum credits.

The Scale of Exposure

Complete Database Index

The following 25 databases comprise the full index:

Government & Public Services (16.6M+ records)

Telecommunications & ISPs (19.7M+ records)

Employment & Education (3.6M+ records)

Retail & E-Commerce (2.3M+ records)

Sports Federations (3.4M+ records)

Financial & Professional Services (2.4M+ records)

Other Services (2.5M+ records)

Why Data Aggregation Is Dangerous

While individual breaches expose isolated data points, aggregated databases compound risk exponentially:

1. Cross-Referencing Enables Identity Reconstruction

When records from 25 different sources are merged, attackers can:

• Match partial records across datasets
• Fill gaps in victim profiles
• Verify data accuracy through correlation
• Build comprehensive identity packages

2. Verified Data Commands Premium Prices

The listing emphasizes "verified records" — meaning the data has been:

• De-duplicated and cleaned
• Validated against live systems
• Tested for freshness and accuracy
• Organized for immediate exploitation

3. Searchable Indexes Enable Targeted Attacks

Unlike raw data dumps, indexed databases allow attackers to:

Query: "Find all records matching:
  - Age: 35-55
  - Income: >€80,000
  - Location: Paris
  - Has mortgage: Yes"

Result: Targeted list for financial fraud

Attack Vectors Enabled

With 52 million French records indexed, criminal operations can scale dramatically:

Identity Fraud

Social Engineering

• Spear phishing: Personalized attacks using real employer, bank, or family details
• Vishing: Phone scams leveraging verified phone numbers with personal context
• CEO fraud: Targeting executives with researched profiles
• Romance scams: Building fake personas using real-world details

Financial Crimes

• SIM swapping at scale using verified phone/identity combinations
• Credit card fraud using aggregated payment histories
• Cryptocurrency theft through targeted phishing
• Real estate fraud with complete identity documentation

High-Value Targets in the Index

ANTS — National Secure Documents Agency

The 12 million records from ANTS (Agence Nationale des Titres Sécurisés) are particularly concerning. This agency handles:

• Passports and national ID cards
• Driver's licenses
• Vehicle registration documents
• Foreigner residence permits

Breach of ANTS data could enable:

• Document fraud at scale
• Identity theft with government-level verification data
• Border crossing fraud
• Vehicle registration fraud

CAF / Pass'Sport — Social Security Data

The 6.4 million records from CAF (Caisse d'Allocations Familiales) and Pass'Sport contain:

• Social security numbers
• Family composition data
• Income declarations
• Youth sports program enrollment

This data enables benefit fraud and targeted social engineering against families.

Hellowork — Employment Data

The 2.8 million job seeker records include:

• CVs with full work history
• Salary expectations
• Contact information
• Professional qualifications

Ideal for recruiter impersonation and employment scams.

Why France Is a "Leaky Country"

The threat actor's characterization reflects systemic issues:

The index spans 2023–2025 breaches, indicating ongoing vulnerability rather than isolated incidents.

What This Means for French Organizations

Immediate Risks

Organizations whose data may be included in these 25 source datasets face:

1. Regulatory exposure: GDPR notification requirements and potential fines
2. Reputational damage: Loss of customer trust when breaches surface
3. Fraud liability: Increased fraud attempts against customers
4. Legal action: Potential class action from affected individuals

Customer Impact

French citizens should assume their data may be compromised and:

• Enable fraud alerts with credit agencies
• Monitor accounts for unauthorized activity
• Use unique passwords across all services
• Enable MFA on financial and email accounts
• Be skeptical of unsolicited contact (even if caller knows personal details)

Defensive Measures

For Organizations

Immediate:

• Audit recent data access logs for anomalies
• Review third-party vendor security posture
• Implement or enhance data classification
• Enable database activity monitoring

Strategic:

• Adopt encryption at rest for all sensitive data
• Implement data minimization (don't store what you don't need)
• Deploy behavioral analytics for account monitoring
• Conduct regular penetration testing

For Individuals

The Aggregation Economy

This incident highlights a maturing cybercrime ecosystem where:

1. Initial access brokers steal raw data
2. Data processors clean, verify, and enrich records
3. Index operators aggregate and organize for searchability
4. Fraud operators purchase targeted subsets for specific schemes

Each layer adds value — and increases danger. A threat actor like Addka72424 specializing in aggregation represents the industrialization of identity fraud.

Key Takeaways

• 52.5M French records from 25 sources now searchable on dark web
• Government agencies breached: ANTS (12M), CAF/Pass'Sport (6.4M), Francetravail
• Major corporations affected: France.fr ISP (19M), SFR, Chronopost, Cultura, EDF
• Threat actor describes France as "very leaky country" — systemic vulnerability
• Data spans 2023–2025 — indicating ongoing, unresolved security failures
• Verified and indexed — ready for immediate exploitation

The most effective defense against aggregated data attacks is ensuring that even when data is stolen, it remains encrypted and unusable. Traditional perimeter security cannot prevent data aggregation — only data-level protection can limit the damage.

Concerned about data aggregation attacks? Learn how CIFER's encryption architecture ensures your data remains protected even when systems are compromised.