{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en"},"incident":{"id":"edustaff","date":"2026-07-25","year":2026,"org":"Education Ministry staff system","domain":"education.gouv.fr","kind":"government","sector":"Education","sectorLabel":"Education","severity":"critical","status":"confirmed","affected":null,"affectedLabel":"A “significant number” of agents since 2001; exact count unpublished","data":"Identity and professional data; for some, address, phone and social-security number. No banking, passwords or pupil data.","method":"Impersonation of a professional account.","risk":"Durable identity fraud using social-security numbers and employment context.","confidence":"Official disclosure; headcount still unpublished","sourceName":"French Education Ministry","sourceId":"eduStaff","sourceUrl":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-personnels-de-l-education-nationale-505407","sourceIds":["eduStaff"],"lastResearched":"2026-08-16","url":"/incident/edustaff","detail":{"lead":"The Education Ministry disclosed on 31 July 2026 that a professional account had been impersonated during the night of 25 July, giving fraudulent access to an information system dedicated to staff training. The ministry security operations centre was alerted on 26 July and external access was suspended.\n\nThe system contained identity and professional information about agents who had worked in academies since 2001. The ministry described the potential population only as a significant number of agents. No official quantified update was found before the 16 August research cutoff.","timeline":[{"date":"2026-07-25","label":"Fraudulent access occurs during the night after impersonation of a professional account."},{"date":"2026-07-26","label":"COSSIM is alerted. External access to the system is suspended and a crisis cell is activated."},{"date":"2026-07-31","label":"The ministry publicly discloses the incident and says the exact scope is still under investigation."}],"how":"The ministry describes the mechanism as impersonation of a professional account. It does not disclose how that account was compromised, whether MFA was present, or whether any software flaw was also involved. This is the third major Education Ministry incident in the 2026 dataset and the second whose public core is compromised credentials.","taken":"Potentially exposed information covers identity and professional data, including status and functions, for staff who worked in academies since 2001. For some records, postal address, phone number and social-security number are also present. Because the exact number remains unknown, no numeric value is used in aggregate charts.","notTaken":"The ministry explicitly states that the system does not contain banking data, passwords or pupil data.","impact":"Social-security numbers and long-lived identity information create durable fraud risk. Unlike a password, a social-security identifier is not something a person can simply rotate after a breach. Employment role and contact details also support convincing ministry or payroll impersonation.","response":"The ministry suspended external access, activated a crisis cell, filed a complaint, notified ANSSI and CNIL, began checks across its other systems, and said potentially affected staff would be informed. It also reiterated that it had been strengthening security for several months.","methodDisclosure":"partial","revision":"No later official public person count was identified through the 16 August research cutoff. The record does not guess a headcount from the age of the database or the size of the ministry.","quotes":[{"text":"a significant number of its agents","original":"un nombre important de ses agents","originalLang":"fr","attribution":"French Education Ministry, 31 July 2026","sourceId":"eduStaff"},{"text":"the investigations are continuing","original":"les investigations se poursuivent","originalLang":"fr","attribution":"French Education Ministry, 31 July 2026","sourceId":"eduStaff"}]}},"source":{"id":"eduStaff","name":"French Education Ministry - Staff-data incident","url":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-personnels-de-l-education-nationale-505407","publisher":"Ministry of Education","kind":"primary","published":"2026-07-31"},"sources":[{"id":"eduStaff","name":"French Education Ministry - Staff-data incident","url":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-personnels-de-l-education-nationale-505407","publisher":"Ministry of Education","kind":"primary","published":"2026-07-31"}]}