France
Education & Research
Student & Identity Data
For Sale
Unverified
CNAM Data Claim Lists 882,918 Records With Birth Details and Internal Student IDs
Overview
An actor using the handle "Syrv4x" claims to be selling a Conservatoire National des Arts et Métiers (CNAM) dataset. CNAM is described in the listing as a French public institution focused on lifelong learning, adult professional training and scientific research.
The listing advertises 882,918 records in a 289 MB file. The visible field list includes internal and external identifiers, surnames, usual names, given names, normalized-name fields, dates of birth, birth departments, birth communes, owning entities and record-creation dates. The actor also advertises a 1,500-line sample and asks interested buyers to make an offer. The dataset, its source, the stated record count and the actor's possession of the full material have not been independently verified.
Post details
FranceWhat the post claims
- 882,918 records advertised
- 289 MB file advertised
- Internal identifier field listed
- External identifier field listed
- Surname field listed
- Usual-name field listed
- Given-name field listed
- Normalized-name fields listed
- Date-of-birth field listed
- Birth-department field listed
- Birth-commune field listed
- Owning-entity field listed
- Record-creation date listed
- 1,500-line sample advertised
- Price listed as offer
- No acquisition method stated
The listing separately claims 882,917 surname values with 266,029 unique surnames, 874,297 first-name values with 108,635 unique first names, 434,794 usual-name values with 161,315 unique values, and 882,927 internal student ID values with 773,306 unique IDs. These figures are presented by the actor and have not been independently validated.
Screenshots
IOCs & contact identifiers
Identifiers directly visible in the listing. These support correlation and do not independently verify the dataset claim.
| Type | Identifier | Source |
|---|---|---|
| Actor handle | Syrv4x | Screenshot 1 |
| Telegram | @Syrv4x | Screenshot 1 |
| Named organization domain | cnam[.]fr | Screenshot 1 |
The domain identifies the organization named in the claim, not malicious infrastructure. No Tox ID, Session ID, malware hash or attacker-controlled IP address is visible. Student and personal identifiers shown in the purported evidence are not included in this table. URLs to any data will always be blurred out, but are available for subscribers on the threat feed or ransomware feed.
Mapped techniques
Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.
- Collection T1213.006 Data from Information Repositories: Databases Inferred The listing presents structured records containing identifiers, names, dates and locations of birth, owning-entity information and record-creation dates. The supplied material does not reveal how the data was obtained or establish unauthorized access to CNAM systems.
Potential impact
If authentic, the claimed dataset could expose names, dates and locations of birth, internal student identifiers and other institutional identifiers at significant scale. The combination could support targeted phishing, impersonation, identity fraud and other social-engineering activity involving students, learners or other individuals represented in the records.
Status Unverified
Dark Web Informer has not independently verified the dataset's authenticity, source, 289 MB size, 882,918-record count, sample contents or current availability. The supplied material shows the listing and a sample rather than the full dataset.
