France has confirmed a data breach at the government agency responsible for issuing and managing citizens' identity documents, including national identity cards, passports, and immigration papers, with reports suggesting the personal data of millions of people may have been compromised.

The Agence Nationale des Titres Sécurisés (ANTS) announced on Wednesday that the data stolen in the breach could include full names, dates and places of birth, mailing and email addresses, and phone numbers. ANTS said the investigation to determine how the breach occurred and its full impact is ongoing, and that people whose data was affected are being notified.

ANTS said it detected the attack on April 15, but did not specify how many people were affected. However, reporting by security publication Bleeping Computer suggests the scale could be significant: a hacker has advertised the stolen data on a hacking forum, claiming to hold a database containing 19 million records

The hacker's forum post referenced the same categories of personal information cited in ANTS's official announcement, and was published before ANTS publicly disclosed the breach on April 20.

No attribution for the attack has been made public, and it is not yet known whether the stolen data has been sold or further distributed. The French government has not commented on the scale of the breach beyond ANTS's initial statement.

The incident is among the most serious breaches of government-held personal data in France in recent years, given that ANTS sits at the centre of the country's identity document infrastructure. A breach of this nature raises particular concerns about identity fraud and document forgery, given the sensitivity of the information held by the agency.