25 July 2026
Education Ministry staff system
Government Education
The Education Ministry disclosed on 31 July 2026 that a professional account had been impersonated during the night of 25 July, giving fraudulent access to an information system dedicated to staff training. The ministry security operations centre was alerted on 26 July and external access was suspended.
The system contained identity and professional information about agents who had worked in academies since 2001. The ministry described the potential population only as a significant number of agents. No official quantified update was found before the 16 August research cutoff.
Dated facts in the public record
Fraudulent access occurs during the night after impersonation of a professional account.
COSSIM is alerted. External access to the system is suspended and a crisis cell is activated.
The ministry publicly discloses the incident and says the exact scope is still under investigation.
How it happened
The ministry describes the mechanism as impersonation of a professional account. It does not disclose how that account was compromised, whether MFA was present, or whether any software flaw was also involved. This is the third major Education Ministry incident in the 2026 dataset and the second whose public core is compromised credentials.
What was exposed
Potentially exposed information covers identity and professional data, including status and functions, for staff who worked in academies since 2001. For some records, postal address, phone number and social-security number are also present. Because the exact number remains unknown, no numeric value is used in aggregate charts.
What was not in scope
The ministry explicitly states that the system does not contain banking data, passwords or pupil data.
What it meant in practice
Social-security numbers and long-lived identity information create durable fraud risk. Unlike a password, a social-security identifier is not something a person can simply rotate after a breach. Employment role and contact details also support convincing ministry or payroll impersonation.
What was done next
The ministry suspended external access, activated a crisis cell, filed a complaint, notified ANSSI and CNIL, began checks across its other systems, and said potentially affected staff would be informed. It also reiterated that it had been strengthening security for several months.
What later reporting changed
No later official public person count was identified through the 16 August research cutoff. The record does not guess a headcount from the age of the database or the size of the ministry.
In their words
a significant number of its agents
Original un nombre important de ses agents
French Education Ministry, 31 July 2026
the investigations are continuing
Original les investigations se poursuivent
French Education Ministry, 31 July 2026
What does this mean?
- MFA (multi-factor authentication)
- A second proof of identity on top of the password — a code, an app or a security key. Phishing-resistant methods are keys and passkeys.
- Credentials
- A username and password pair, or the equivalent key an application uses to log in.