{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en"},"incident":{"id":"educompas","date":"2026-03-15","year":2026,"org":"Education Ministry / COMPAS","domain":"education.gouv.fr","kind":"government","sector":"Education","sectorLabel":"Education","severity":"high","status":"confirmed","affected":243000,"affectedLabel":"About 243,000 agents, trainees and permanent staff","data":"Identity, addresses, phone numbers and absence periods without the medical reason; tutor names and professional numbers.","method":"Impersonation of an external account.","risk":"Harassment, impersonation and workplace-targeted fraud against education staff.","confidence":"Official government disclosure","sourceName":"French Education Ministry","sourceId":"eduCompas","sourceUrl":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-certains-personnels-de-l-education-nationale-470657","sourceIds":["eduCompas","eduCompasSenat","eduCompasRtl","eduCompasAef"],"lastResearched":"2026-08-16","url":"/incident/educompas","detail":{"lead":"An attacker used an impersonated external account to reach COMPAS, the Education Ministry information system used to manage trainee teachers. The fraudulent access occurred on 15 March 2026. The ministry’s security operations centre was alerted on 19 March after unauthorised dissemination of COMPAS data was identified.\n\nAbout 243,000 agents, including trainees and permanent staff recorded in the system, had data exfiltrated. That figure is an official approximate person count.","timeline":[{"date":"2026-03-15","label":"Fraudulent access to COMPAS occurs after impersonation of an external account."},{"date":"2026-03-19","label":"COSSIM, the ministry security operations centre, is alerted. External access is closed and a crisis cell is activated."},{"date":"2026-03-21","label":"CNIL is notified, according to a later Senate response."},{"date":"2026-03-23","label":"Public disclosure establishes an approximate 243,000-person scope."},{"date":"2026-03-24","label":"A complaint is filed, according to the minister’s Senate response."},{"date":"2026-04-01","label":"The ministry says the 243,000 people concerned will be individually informed by this date."}],"how":"The ministry says the access followed impersonation of an external account. It does not describe a software vulnerability in COMPAS or explain how the external account was obtained. The event is therefore compromised credentials used for valid authenticated access.","taken":"Names and other identity information, postal addresses, phone numbers and periods of absence without the health reason, for about 243,000 agents recorded in COMPAS. Tutor identity and professional telephone numbers were also exposed. Security reporting said samples later appeared on data-trading venues; any reseller volume is not a second official count.","notTaken":"The official disclosure emphasised that absence periods did not include the underlying health reason. The public primary source reviewed does not provide evidence for broader claims about medical files or banking credentials.","impact":"Teachers and other staff expressed concern that the data could be used to locate or target them. Real home addresses, phone numbers and employment context can support harassment, impersonation and tailored fraud even when the dataset does not contain passwords.","response":"The ministry suspended external access to COMPAS, activated a crisis cell, carried out checks across other systems, notified ANSSI and the CNIL, filed a complaint and informed staff. In parliamentary debate, the minister also described a wider government security programme focused on MFA, segmentation and reduced application exposure.","methodDisclosure":"partial","revision":"A later Senate response supplies dates for CNIL notification (21 March), the complaint (24 March) and planned individual notification (by 1 April). It strengthens the cross-case finding that credential impersonation is a recurring weakness.","quotes":[{"text":"impersonation of an external account","original":"usurpation d’un compte externe","originalLang":"fr","attribution":"French Education Ministry, 23–24 March 2026","sourceId":"eduCompas"},{"text":"about 243,000 agents","original":"environ 243 000 agents","originalLang":"fr","attribution":"French Education Ministry, 23–24 March 2026","sourceId":"eduCompas"}]}},"source":{"id":"eduCompas","name":"French Education Ministry - COMPAS incident","url":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-certains-personnels-de-l-education-nationale-470657","publisher":"Ministry of Education","kind":"primary","published":"2026-03-23"},"sources":[{"id":"eduCompas","name":"French Education Ministry - COMPAS incident","url":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-certains-personnels-de-l-education-nationale-470657","publisher":"Ministry of Education","kind":"primary","published":"2026-03-23"},{"id":"eduCompasSenat","name":"Sénat — cyber protection of administrations, COMPAS response","url":"https://www.senat.fr/questions/base/2026/qSEQ26030760G.html","publisher":"Sénat","kind":"official","published":"2026-03-26"},{"id":"eduCompasRtl","name":"RTL — 243,000 education staff after COMPAS","url":"https://www.rtl.fr/actu/sciences-tech/ils-peuvent-nous-localiser-l-inquietude-des-enseignants-apres-le-piratage-des-coordonnees-de-243-000-agents-de-l-education-nationale-7900616158","publisher":"RTL","kind":"secondary","published":"2026-03-24"},{"id":"eduCompasAef","name":"AEF Info — COMPAS, 243,000 education staff","url":"https://www.aefinfo.fr/depeche/747986","publisher":"AEF Info","kind":"secondary","published":"2026-03-23"}]}