2026 Campus France — SUB-ZER0 toucan leak claim (unverified); ~18K applications alleged
Data compromised
Actor-claimed international student application JSON (~18,000–18,637 records alleged): names, emails, academic history, study plans, and mobility metadata—unverified
Technical writeup
Unverified actor leak claim — indexed April–May 2026. Threat-intelligence and breach trackers reported SUB-ZER0 (also attributed as ChimeraZ in parallel April 29, 2026 monitoring) distributing a partial database from toucan.campusfrance.org, Campus France's Toucan online application platform for international students. Monitoring cited roughly 18,000 application records in a ~430 MB JSON archive (LeakRadar indexed 18,637 rows in Toucan.campusfrance.org.7z on May 1, 2026). Alleged fields include applicant names, emails, passport and academic details, and visa-coordination metadata. Campus France had not publicly confirmed the incident at catalog time. BreachHistory uses the LeakRadar-indexed 18,637 count labeled unverified pending CNIL or agency confirmation.
Root cause
Unverified leak-site/forum claim targeting toucan.campusfrance.org international-student application platform—Campus France had not confirmed at catalog time