French government agency confirms breach as hacker offers to sell data • Hacker News Board

Re: French government agency confirms breach as hacker offers to sell data

#121

Post by wiether » Thu, Apr 23, 2026, 8:41 PM UTC

progval wrote: post #120

wiether wrote: post #119

Earlier quoted context omitted.

Why do I have to learn about it on HN? I'm tired of having to connect on EDF' shitty website to get a new PDF every three months. I just set it up! A bit bumpy because login on Ameli/Impôts wasn't working on Orion so I had to go on Safari, but otherwise its done. I even have colored pictures on the virtual CNI/Permis! Thanks! EDIT: Why do the put three stats about trains on your linked page?!

> I'm tired of having to connect on EDF' shitty website to get a new PDF every three months. It doesn't look like this app can generate "justificatifs de domicile", only substitutes for an identity card or passport. > Why do the put three stats about trains on your linked page?! I was wondering about that too

> It doesn't look like this app can generate "justificatifs de domicile", only substitutes for an identity card or passport.

You're absolutely right! Damn!

At least it should make it easier to use France Connect with the QR code stuff instead of the credentials from other websites...

Re: French government agency confirms breach as hacker offers to sell data

#122

Post by prmoustache » Thu, Apr 23, 2026, 8:43 PM UTC

vladvasiliu wrote: post #68

gus_massa wrote: post #29

Earlier quoted context omitted.

I'm not sure about France, but here in Argentina all this info is assumed to be public. If you want a credit at a bank or shop, they ask for a physical copy of the national ID [1], probably a photocopy too, an electricity or water bill and perhaps other paperwork that is hard to get (verified phone number???). [1] Do you want my number? It's inside this list: for i in range(1E9): print (i)

It's supposed to be identifying information here. Usually, you can just send copies of those documents, which means that if you're looking to impersonate someone, you can easily produce fakes. And since everyone and their grandmother asks for these, people don't bat an eye and send them. The coup de grace of security in France is signatures, though. Now, since you can't produce a physical signature over the internet,…

Physical signature are as useless anyway. We could just mark an X and it would be exactly the same. It only proves that some anoynmous person had a pen and was not afraid to use it.

Re: French government agency confirms breach as hacker offers to sell data

#123

Post by reorder9695 » Thu, Apr 23, 2026, 8:45 PM UTC

What all these breaches tell me is that personal data should not be required, and especially not stored unless absolutely necessary. I cannot verify how my data is treated once it leaves my device, so how can I possibly trust it will be treated properly and not leaked?

This is a major reason as to why I am so strongly against all this verification shit governments keep trying to push, the best way to keep data secure is not to have it in the first place, therefore my personal data should not leave my device except in the strictest of circumstances for things like my name/DOB/address/SSN.

Re: French government agency confirms breach as hacker offers to sell data

#124

Post by arkh » Thu, Apr 23, 2026, 8:48 PM UTC

signatoremo wrote: post #88

mcmcmc wrote: post #73

Earlier quoted context omitted.

> Penalties don't work for government agencies. Taxpayers would pay for it and it doesn't act as an incentive. This is the same as the rogue police problem in the US. What needs to happen is a shift to personal liability for those responsible.

Personal liability? Are you also against no blame culture that is prevalent in the tech world?

Someone(s), somewhere, is paid "big bucks" to be in charge.

That's the person we should charge. If they cannot be charged for this kind of fuck-ups, then they should not be paid anything for simply rubber-stamping anything going over their desk. A simple machine could do their job.

Re: French government agency confirms breach as hacker offers to sell data

#125

Post by gniv » Thu, Apr 23, 2026, 9:49 PM UTC

loupol wrote: post #6

I received the email telling me I am impacted today. Ironically it changes nothing for me as that same data had already been leaked by the French government agency that handles unemployment benefits a couple years ago. Silly me had not bothered deleting that account even after it was no longer necessary due to finding a new job.

Is it from ANTS? I haven't gotten anything yet.

Re: French government agency confirms breach as hacker offers to sell data

#126

Post by amelius » Thu, Apr 23, 2026, 10:06 PM UTC

AlecSchueler wrote: post #95

amelius wrote: post #41

If governments are treating my personal data as if it is worth nothing, then I'm not going to treat copyrighted works as if they are worth something. If you want to build a society on information, then you cannot forget the most important group.

Let us know how it works out. It's great in theory to stick to your principles but taking on the government in that way is almost certainly a losing battle. There are better ways to bring about change.

It all starts by noticing that there is something odd about the way governments are trying to structure things, and then raising awareness about it.

There might be better ways to bring about change, but if you don't say what they are then that doesn't help much.

Re: French government agency confirms breach as hacker offers to sell data

#127

Post by amelius » Thu, Apr 23, 2026, 10:14 PM UTC

Would it be possible to spread so much noise that data like this becomes useless? Could an LLM be used to help here?

Re: French government agency confirms breach as hacker offers to sell data

#128

Post by numpad0 » Thu, Apr 23, 2026, 10:27 PM UTC

nout wrote: post #78

hk__2 wrote: post #10

> the data stolen in the breach could include full names, dates and places of birth, mailing and email addresses, and phone numbers on an undisclosed number of citizens Nothing really new here sadly, this information about me have leaked half a dozen of times in the past 2-3 years or so. These things will never change if the only penalty the company/agency gets is "send a message to your users saying you are sorry an…

Or maybe the government should not require companies to KYC you for every little stupid thing or action you do in this world. What happened to requiring only the information that's actually required? Why do I need to be KYCd in the systems when buying banana, ordering delivery, etc. Because of the inevitable breaches and leaks - KYC is the illicit activity. The selling point of KYC was preventing fraud and money laun…

Yeah, it should be made illegal to hold like, more than x columns of PII per entity or bank branch or something. It's just not smart to allow big database of everyone to be made and to expect you stay the one to abuse than to be nails that gets beaten using it.

Re: French government agency confirms breach as hacker offers to sell data

#129

Post by throw-the-towel » Thu, Apr 23, 2026, 10:28 PM UTC

traceroute66 wrote: post #112

nout wrote: post #78

Earlier quoted context omitted.

Or maybe the government should not require companies to KYC you for every little stupid thing or action you do in this world. What happened to requiring only the information that's actually required? Why do I need to be KYCd in the systems when buying banana, ordering delivery, etc. Because of the inevitable breaches and leaks - KYC is the illicit activity. The selling point of KYC was preventing fraud and money laun…

> Or maybe the government should not require companies to KYC you for every little stupid thing Actually.... Say what you like about the French today, but one good thing they have is an electronic service[1] where you can generate single-use KYC ID: - That only discloses minimum information required - For a specific recipient organisation - For a specific duration - For a specific use-case by that organisation More c…

It's a pity this doesn't work for foreigners resident in France.

Re: French government agency confirms breach as hacker offers to sell data

#130

Post by QuantumFunnel » Thu, Apr 23, 2026, 10:47 PM UTC

nout wrote: post #78

hk__2 wrote: post #10

> the data stolen in the breach could include full names, dates and places of birth, mailing and email addresses, and phone numbers on an undisclosed number of citizens Nothing really new here sadly, this information about me have leaked half a dozen of times in the past 2-3 years or so. These things will never change if the only penalty the company/agency gets is "send a message to your users saying you are sorry an…

Or maybe the government should not require companies to KYC you for every little stupid thing or action you do in this world. What happened to requiring only the information that's actually required? Why do I need to be KYCd in the systems when buying banana, ordering delivery, etc. Because of the inevitable breaches and leaks - KYC is the illicit activity. The selling point of KYC was preventing fraud and money laun…

So that if you ever step out of line with regards to what the government deems "worthy" behavior (whatever the hell that means at any given moment) you can be de-banked and effectively excluded from participating in society