France
Government / Education
Selling
French Ministry of Education Allegedly Breached, With Staff Directories and Student Monitoring Records Offered for Sale
A forum user posting as ZeroBytes claims to have breached Éducation Nationale, the French national education ministry, and is selling what they describe as a partial database totalling 346,178,591 raw lines across three folders. The actor dates the intrusion to July 15, 2026. The material is said to span school system exports, staff exports from 33 academies, and two LDAP directory dumps containing network accounts and hashed passwords. Deduplicated, the poster puts the set at 4,350,358 staff identifiers and 1,224,291 students, and explicitly notes the staff figure spans decades of historical personnel records rather than serving teachers. No sample has been published. The claim is unverified.
▣Post details
France!Allegedly included
- Staff employee identifiers
- Personnel records
- Retiree and former staff data
- Employment convention data
- Training and session records
- Staff availability data
- LDAP network accounts
- Hashed account passwords
- Two academy directories
- Exports from 33 academies
- School system exports
- Student enrolment data
- At risk student monitoring
- No sample published
◱Screenshot
⚠Potential impact
The LDAP dumps are the most immediately actionable element, since directory exports carry network account names and password hashes for two academies, and hashes can be attacked offline at leisure. Any credential still valid would offer a route back into ministry systems rather than merely describing them, which makes this a continuing access risk and not only a disclosure. The student side is the more sensitive in human terms: the exports named include systems used to track pupils identified as struggling or at risk of dropping out, so the records concern minors and attach a judgement about their circumstances to their identity. On the staff side, a set spanning current employees, support roles, former staff and retirees means people who left the profession years ago are exposed by an incident they have no relationship with and will likely never be told about individually.
iStatus
UnverifiedEvidence in the thread is thin, with no sample data of any kind, the poster stating the directory is too large to excerpt and inviting specific requests instead. What supports the claim is its internal specificity: the named systems and academy structures are real and correctly described, and the actor volunteers a correction against their own headline figure, noting that 4.35 million staff records reflect decades of history rather than four million serving teachers, when France has roughly 850,000 active. That caution is worth carrying forward, since the raw line count invites far larger claims than the deduplicated numbers support. Dark Web Informer is not reproducing the off site writeup or the contact routes. The claim is unverified and the ministry has not publicly addressed it.
DARK WEB INFORMER - THREAT INTELLIGENCE
