French Ministry of Education Confirms Massive Data Breach and File Theft

In July 2026, the French Ministry of Education confirmed a fraudulent intrusion into its files, exposing sensitive records spanning over twenty years. According to investigations by the specialized data leak site French Breaches, as reported by CNEWS, the cybercriminal group ZeroBytes exfiltrated 43 gigabytes of data, containing approximately 346 million raw non-deduplicated lines across multiple academic networks.

The Mechanics of the Breach and Discrepancies in Official Accounts

The incident traces back to late July 2026, when the French Ministry of Education identified unauthorized access detected on the night of July 25 following the usurpation of a professional account, as detailed by Comment Ça Marche. Initial ministerial statements indicated that the breach compromised a system of information dedicated to the training of staff who had worked in an academy since 2001, though officials maintained that student information and banking credentials remained secure.

However, subsequent claims by the threat actor group ZeroBytes paint a far more severe picture. The hackers asserted that they maintained access to the infrastructure via a VPN long after the initial detection date. This allowed the group to harvest archives dating back to 2002 across all 33 French academic regions, most notably Créteil and Versailles.

Scope of Compromised Assets and Historical Data Exposure

The stolen data repository encompasses 43 gigabytes distributed across approximately 2,500 files. Analysts processing the raw material note that while the volume reaches 346 million raw data lines, deduplication efforts reveal distinct figures regarding affected individuals. The exposed records include administrative databases containing 4.35 million staff identifiers and approximately 1.22 million student profiles covering primary, middle, and high school tiers, alongside 602,000 academic network accounts.

Data points within the exfiltrated files span identities, birth dates, addresses, e-mails, telephones, school and disciplinary data, assignments, grades, administrative information, and password hashes.

Fiscal Vulnerabilities and Enterprise Risk Management

The ongoing investigation by French authorities underscores the persistent challenges public institutions face in securing legacy digital assets against persistent threat actors.