15 March 2026
Education Ministry / COMPAS
Government Education
An attacker used an impersonated external account to reach COMPAS, the Education Ministry information system used to manage trainee teachers. The fraudulent access occurred on 15 March 2026. The ministry’s security operations centre was alerted on 19 March after unauthorised dissemination of COMPAS data was identified.
About 243,000 agents, including trainees and permanent staff recorded in the system, had data exfiltrated. That figure is an official approximate person count.
Dated facts in the public record
Fraudulent access to COMPAS occurs after impersonation of an external account.
COSSIM, the ministry security operations centre, is alerted. External access is closed and a crisis cell is activated.
CNIL is notified, according to a later Senate response.
Public disclosure establishes an approximate 243,000-person scope.
A complaint is filed, according to the minister’s Senate response.
The ministry says the 243,000 people concerned will be individually informed by this date.
How it happened
The ministry says the access followed impersonation of an external account. It does not describe a software vulnerability in COMPAS or explain how the external account was obtained. The event is therefore compromised credentials used for valid authenticated access.
What was exposed
Names and other identity information, postal addresses, phone numbers and periods of absence without the health reason, for about 243,000 agents recorded in COMPAS. Tutor identity and professional telephone numbers were also exposed. Security reporting said samples later appeared on data-trading venues; any reseller volume is not a second official count.
What was not in scope
The official disclosure emphasised that absence periods did not include the underlying health reason. The public primary source reviewed does not provide evidence for broader claims about medical files or banking credentials.
What it meant in practice
Teachers and other staff expressed concern that the data could be used to locate or target them. Real home addresses, phone numbers and employment context can support harassment, impersonation and tailored fraud even when the dataset does not contain passwords.
What was done next
The ministry suspended external access to COMPAS, activated a crisis cell, carried out checks across other systems, notified ANSSI and the CNIL, filed a complaint and informed staff. In parliamentary debate, the minister also described a wider government security programme focused on MFA, segmentation and reduced application exposure.
What later reporting changed
A later Senate response supplies dates for CNIL notification (21 March), the complaint (24 March) and planned individual notification (by 1 April). It strengthens the cross-case finding that credential impersonation is a recurring weakness.
In their words
impersonation of an external account
Original usurpation d’un compte externe
French Education Ministry, 23–24 March 2026
about 243,000 agents
Original environ 243 000 agents
French Education Ministry, 23–24 March 2026
What does this mean?
- MFA (multi-factor authentication)
- A second proof of identity on top of the password — a code, an app or a security key. Phishing-resistant methods are keys and passkeys.
- Exfiltration
- Copying data out of a system to somewhere the attacker controls.
- Credentials
- A username and password pair, or the equivalent key an application uses to log in.