> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# French Ministry of Education Allegedly Breached, With Staff Directories and Student Monitoring Records Offered for Sale
- URL: https://darkwebinformer.com/french-ministry-of-education-allegedly-breached-with-staff-directories-and-student-monitoring-records-offered-for-sale/
- Published: 2026-08-17T21:19:01.000Z
- Updated: 2026-08-17T21:19:01.000Z
- Author: Dark Web Informer
- Tags: Data Breaches

Breach Report ![France flag](https://flagcdn.com/w40/fr.png)France Government / Education Selling 

## French Ministry of Education Allegedly Breached, With Staff Directories and Student Monitoring Records Offered for Sale

A forum user posting as **ZeroBytes** claims to have breached **Éducation Nationale**, the French national education ministry, and is selling what they describe as a partial database totalling **346,178,591 raw lines** across three folders. The actor dates the intrusion to **July 15, 2026**. The material is said to span school system exports, staff exports from 33 academies, and **two LDAP directory dumps containing network accounts and hashed passwords**. Deduplicated, the poster puts the set at **4,350,358 staff identifiers and 1,224,291 students**, and explicitly notes the staff figure spans decades of historical personnel records rather than serving teachers. **No sample has been published**. The claim is **unverified**.

Severity HIGH 

Raw lines346.1M

Staff IDs4.35M

Students1.22M

ActorZeroBytes

### ▣Post details

TargetÉducation Nationale

Country![France flag](https://flagcdn.com/w40/fr.png)France

SectorNational education ministry

ListingSelling, partial database

Volume346,178,591 raw lines

Breach dateStated as July 15, 2026

ObservedAug 17, 2026

ActorZeroBytes

### !Allegedly included

- Staff employee identifiers
- Personnel records
- Retiree and former staff data
- Employment convention data
- Training and session records
- Staff availability data
- LDAP network accounts
- Hashed account passwords
- Two academy directories
- Exports from 33 academies
- School system exports
- Student enrolment data
- At risk student monitoring
- No sample published

### ◱Screenshot

[ ![French Ministry of Education database sale forum post screenshot, August 2026](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/08/79832598723598723596872359781.png) Screenshot 1 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/08/79832598723598723596872359781.png) 

### ⚠Potential impact

The **LDAP dumps are the most immediately actionable element**, since directory exports carry network account names and password hashes for two academies, and hashes can be attacked offline at leisure. Any credential still valid would offer a route back into ministry systems rather than merely describing them, which makes this a **continuing access risk and not only a disclosure**. The student side is the more sensitive in human terms: the exports named include systems used to **track pupils identified as struggling or at risk of dropping out**, so the records concern minors and attach a judgement about their circumstances to their identity. On the staff side, a set spanning current employees, support roles, former staff and retirees means **people who left the profession years ago are exposed by an incident they have no relationship with** and will likely never be told about individually.

### iStatus

Unverified 

Evidence in the thread is **thin, with no sample data of any kind**, the poster stating the directory is too large to excerpt and inviting specific requests instead. What supports the claim is its internal specificity: the named systems and academy structures are real and correctly described, and the actor **volunteers a correction against their own headline figure**, noting that 4.35 million staff records reflect decades of history rather than four million serving teachers, when France has roughly 850,000 active. That caution is worth carrying forward, since the raw line count invites far larger claims than the deduplicated numbers support. Dark Web Informer is **not reproducing the off site writeup or the contact routes**. The claim is **unverified** and the ministry has not publicly addressed it.

Want everything on this breach? **Paid subscribers** get the full claim details and more. Check out the [threat feed](https://darkwebinformer.com/threat-feed/), then after subscribing, search there for this alert. [View pricing →](https://darkwebinformer.com/pricing) 

[DARK WEB INFORMER](https://darkwebinformer.com/) \- THREAT INTELLIGENCE