French authorities have detained a 15-year-old suspected of involvement in a data breach at France Titres, the government agency responsible for issuing official documents.

“Between 12 and 18 million data records were reportedly being offered for sale on cybercriminal forums by a hacker known as “breach3d,“ the Paris Prosecutor’s Office said in a press release.

ANTS detected suspicious activity on its network on April 13 and confirmed the authenticity of the data being sold. The Paris prosecutor’s cybercrime unit was notified of the breach on April 16 and opened an investigation.

The agency disclosed the breach on April 20, noting that the leaked data included ID numbers, names, email addresses, dates of birth, and unique account identifiers, with some records also listing postal addresses, places of birth, and phone numbers.

Prosecutors noted that the offense carries a penalty of up to seven years in prison and a €300,000 fine.

The minor is expected to be charged in connection with unauthorized access, data extraction and disruption of a state-run system, as well as possession of tools or software enabling such offenses.