Massive Data Breach Exposes 2.1 Million Records from French Immigration Portal On January 1, 2026, a cyberattack targeting France’s Office Français de l’Immigration et de l’Intégration (OFII) sent shockwaves through the cybersecurity community. A hacker leaked a database containing over 2.1 million records—approximately 1 GB of sensitive personal and administrative data—exfiltrated from the Administration Numérique des Étrangers en France (ANEF) portal (etrangers-en-france.interieur.gouv.fr). The breach, announced on a dark web forum, includes highly detailed information on foreign nationals residing in France. While French authorities have yet to officially confirm the incident, technical analysis of leaked samples—including 1,000 verified records from 2023–2024—supports the hacker’s claims. The data aligns with official administrative standards, featuring precise identifiers such as AGDREF numbers (10-digit foreigner IDs) and Contrat d’Intégration Républicaine (CIR) reference codes. The exposed records contain comprehensive personal and administrative details, including: - Full identities: Names, birthdates, nationalities, and gender. - Contact information: Home addresses, phone numbers, and personal emails. - Family status: Marital status and children’s birth years. - Immigration records: Entry dates, residency permit types (e.g., "Parent d’enfant français"), decision prefectures, and internal case numbers. The breach’s scale suggests the vulnerability may extend to records as recent as late 2025, though the leaked samples primarily cover 2023–2024. The depth of the data—cross-referencing legal terminology from France’s Code de l’entrée et du séjour des étrangers (CESEDA)—heightens risks of targeted phishing, identity theft, and extortion for affected individuals. This incident marks one of the most severe breaches of a French government agency, underscoring persistent challenges in securing digitalized administrative systems. The ANEF portal, a cornerstone of France’s immigration digitization efforts, has faced scrutiny over data protection in the past. If confirmed, the leak would rank among the largest compromises of state-held personal data in the country’s history.