2026 France Éducation nationale — staff training SI breach (Jul 25); agents since 2001
Data compromised
Identity and professional info (status/functions) for agents who worked in académies since 2001; for some also postal address, phone, and Social Security (NIR) numbers — ministry says no bank details, passwords, or pupil data in this system; exact headcount not published
Technical writeup
Verified ministry disclosure — communiqué reported July 31, 2026. French Ministry of National Education said a fraudulent intrusion into the personnel-training information system occurred overnight July 25, 2026 after usurpation of a professional account. Potentially exposed: identity and professional data (status/functions) for ministry agents who served in académies since 2001; for a portion also postal address, phone, and numéro de sécurité sociale (NIR). Ministry states the system held no bank details, passwords, or pupil data. Exact affected count not published (“nombre important” / all agents registered since 2001 potentially in scope — not proof every record was exfiltrated). SOC alerted July 26; external access suspended; complaint filed; ANSSI and CNIL notified. Distinct from March 2026 Compas incident (~243,000 agents) catalogued separately. recordsAffected 0 pending attested census.
Root cause
Fraudulent access overnight 25 July 2026 via usurped professional account into the personnel-training information system (ministry communiqué)
References
- https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-certains-personnels-de-l-education-nationale-470657
- https://www.midilibre.fr/2026/07/31/leducation-nationale-victime-dune-cyberattaque-massive-les-numeros-de-securite-sociale-et-adresses-de-professeurs-en-postes-depuis-2001-derobes-13492238.php
- https://www.leparisien.fr/faits-divers/adresses-numeros-statuts-des-donnees-dagents-du-ministere-de-leducation-nationale-potentiellement-derobees-lors-dune-cyberattaque-31-07-2026-DXXTUXBCURCW3E72ERVQ6RY53Y.php
- https://www.cyberattaque.org/education-nationale-25-ans-de-donnees-dagents-potentiellement-exposees-apres-une-cyberattaque/