French authorities have detained a 15-year-old boy suspected of selling data stolen in a cyberattack on France Titres (ANTS), the country's agency for issuing and managing administrative documents.
The government agency confirmed the breach and the authenticity of the data, which was put up for sale on a cybercriminal forum by someone using the pseudonym ‘breach3d’.
The minor faces charges of unauthorized access, persistence, and exfiltration of data from a state-run automated personal data processing system, as well as possession of software that enables these crimes.
The crimes carry a maximum sentence of seven years in prison and a fine of €300,000, according to a press release from the Paris Public Prosecutor's Office.
The announcement came after a threat actor claimed to have compromised ANTS and offered to sell up to 19 million records allegedly stolen in the attack.
In an update on the incident, the agency reported that the number of accounts impacted was 11.7 million, but the stolen data could not be used for unauthorized access.
While awaiting the investigating judge's decision, the 15-year-old minor has not been formally charged.