{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en"},"incident":{"id":"edustudents","date":"2026-04-14","year":2026,"org":"Education Ministry / ÉduConnect","domain":"education.gouv.fr","kind":"government","sector":"Education","sectorLabel":"Education","severity":"critical","status":"confirmed","affected":null,"affectedLabel":"Official pupil count unpublished","data":"Name, ÉduConnect identifier, school and class, email if supplied, and activation code for accounts not yet activated.","method":"Impersonated staff account plus a vulnerability exploited shortly before it was fixed.","risk":"School-themed phishing aimed at pupils and parents.","confidence":"Official disclosure; exact pupil count unpublished","sourceName":"French Education Ministry","sourceId":"eduStudents","sourceUrl":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-certains-eleves-de-l-education-nationale-504443","sourceIds":["eduStudents","eduStudentsLemonde","eduStudentsAa","eduStudents01net"],"lastResearched":"2026-08-16","url":"/incident/edustudents","detail":{"lead":"The Education Ministry disclosed on 14 April 2026 that pupil data had been exfiltrated from a service adjacent to ÉduConnect. An authorised staff account was impersonated at the end of 2025, and a security flaw identified in December 2025 was exploited shortly before it was fixed.\n\nThe ministry confirmed exfiltration but did not publish a final pupil count. Criminal claims of 3.5 million pupils and 7.2 million report cards remain claims, not the ministry’s verified scope.","timeline":[{"date":"2025-12-01","label":"An authorised staff account is impersonated at the end of 2025, giving fraudulent access to the pupil-account management service (exact day not published)."},{"date":"2025-12-15","label":"A vulnerability in the service is identified in December and, the ministry says, exploited shortly before it was fixed (exact day not published)."},{"date":"2026-04-12","label":"A criminal group publicly advertises data it claims came from the education environment, including a multi-million-pupil figure."},{"date":"2026-04-14","label":"Education Ministry publicly confirms exfiltration; the exact pupil count is still under evaluation."},{"date":"2026-04-18","label":"Le Monde reports that the ministry still does not know the exact number of pupils affected."},{"date":"2026-06-09","label":"French investigators arrest seven people reported as alleged members of DumpSec, in a broader investigation into more than 1,500 targeted entities. This is attribution context; it does not validate the advertised pupil count."},{"date":"2026-06-12","label":"Security reporting connects the arrests with a wider DumpSec campaign and repeats the group’s ÉduConnect claims. Those numbers still remain outside the ministry’s confirmed count."}],"how":"Unlike COMPAS, this incident combines compromised identity with a software weakness. The ministry says an authorised staff account was impersonated and that a vulnerability in the account-management service was exploited shortly before it was fixed. The public statement does not name the vulnerability, provide a CVE, or explain the precise request sequence.","taken":"Officially confirmed fields are pupil first and last name, ÉduConnect identifier, school and class, email if provided, and activation code only for accounts not yet activated. The ministry confirmed data exfiltration. It did not publish a final pupil count by the research cutoff.","notTaken":"The ministry says accounts already activated by pupils and their guardians were not compromised and could continue to be used safely. It reset codes for unactivated accounts and blocked undistributed or unactivated accounts. The official field list does not include health data or social-security numbers.","impact":"Because the dataset concerns minors and schools, the main risk is highly credible school-themed phishing aimed at pupils and parents. School, class, identity and activation context can be used to impersonate a school administrator, parent portal or account-support process.","response":"The ministry suspended access to the affected service, activated a crisis cell, reset activation codes, blocked unactivated accounts, began strengthening access with MFA, notified ANSSI and CNIL, and filed a complaint. Families were warned to be alert to school-themed fraud.","methodDisclosure":"partial","attackerClaim":"DumpSec, or accounts attributed to the group, advertised about 3.5 million pupils and 7.2 million report cards. Those figures remain criminal claims. They are not a substitute for a ministry-verified pupil count.","revision":"In June 2026, French investigators arrested seven people reported as alleged DumpSec members in a broader investigation. That improves attribution context at campaign level. It does not validate the advertised pupil or report-card counts, and the official student count remains unpublished.","quotes":[{"text":"the exact number is being evaluated","original":"le nombre exact est en cours d’évaluation","originalLang":"fr","attribution":"French Education Ministry, 14 April 2026","sourceId":"eduStudents"},{"text":"impersonation of an authorised staff member’s account","original":"usurpation d’identité du compte d’un personnel habilité","originalLang":"fr","attribution":"French Education Ministry, 14 April 2026","sourceId":"eduStudents"}]}},"source":{"id":"eduStudents","name":"French Education Ministry - EduConnect incident","url":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-certains-eleves-de-l-education-nationale-504443","publisher":"Ministry of Education","kind":"primary","published":"2026-04-14"},"sources":[{"id":"eduStudents","name":"French Education Ministry - EduConnect incident","url":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-certains-eleves-de-l-education-nationale-504443","publisher":"Ministry of Education","kind":"primary","published":"2026-04-14"},{"id":"eduStudentsLemonde","name":"Le Monde — education sector as a cyber target","url":"https://www.lemonde.fr/pixels/article/2026/04/18/fuites-de-donnees-l-education-nationale-une-cible-vulnerable-face-aux-cyberattaques_6681062_4408996.html","publisher":"Le Monde","kind":"secondary","published":"2026-04-18"},{"id":"eduStudentsAa","name":"Anadolu Agency — pupil data compromised","url":"https://www.aa.com.tr/fr/france/cyberattaque-contre-l-%C3%A9ducation-nationale-des-donn%C3%A9es-d-%C3%A9l%C3%A8ves-compromises/3905581","publisher":"Anadolu Agency","kind":"secondary","published":"2026-04-14"},{"id":"eduStudents01net","name":"01net — seven arrests after a wider DumpSec investigation","url":"https://www.01net.com/actualites/fuite-donnees-france-arrete-7-jeunes-hackers-apres-plus-1500-cyberattaques.html","publisher":"01net","kind":"secondary","published":"2026-06-12"}]}