Post #1442337
2026-04-20 10:57 UTC
Oh FFS seems the website for ANTS (National Agency for Secured Documents) was letting you get data from another user by just changing the ID in the request. 19M accounts leaked (~1/3 of the french population).
Also, if that's how it worked, how the fuck can you not notice it for long enough that the attacker was able to get everything.
This is 🥖excellence francaise🥖 for you all.
https://frenchbreaches.com/blog/fuite-massive-a-lants-jusqua-19-millions-de-donnees-sensibles-exposees (FR)
Replies (3)
-
@rafi0t@social.yoyodyne-it.eu 2026-04-20 11:01
Like seriously, if the attack was: 1. create an account 2. login 3. iterate over all the other accounts 4. profit people need to be fired. And that includes anyone supposed to do any security related stuff there. It should have been absolutely obvious in the logs.
-
@Tamber@taur.zone 2026-04-20 11:54
@rafi0t@social.yoyodyne-it.eu I would call that amateur-hour work, but most of the amateurs I know would do *so* much better than that :cripes: Painful.
-
@gunstick@mastodon.opencloud.lu 2026-04-20 13:55
@rafi0t@social.yoyodyne-it.eu And in Luxembourg everybody ignores that you can easily exfiltrate all payconiq phonenumber => full name associations. Takes only 5 million requests.