Education Ministry / ÉduConnect

Dated facts in the public record

1. 1 December 2025

   An authorised staff account is impersonated at the end of 2025, giving fraudulent access to the pupil-account management service (exact day not published).

2. 15 December 2025

   A vulnerability in the service is identified in December and, the ministry says, exploited shortly before it was fixed (exact day not published).

3. 12 April 2026

   A criminal group publicly advertises data it claims came from the education environment, including a multi-million-pupil figure.

4. 14 April 2026

   Education Ministry publicly confirms exfiltration; the exact pupil count is still under evaluation.

5. 18 April 2026

   Le Monde reports that the ministry still does not know the exact number of pupils affected.

6. 9 June 2026

   French investigators arrest seven people reported as alleged members of DumpSec, in a broader investigation into more than 1,500 targeted entities. This is attribution context; it does not validate the advertised pupil count.

7. 12 June 2026

   Security reporting connects the arrests with a wider DumpSec campaign and repeats the group’s ÉduConnect claims. Those numbers still remain outside the ministry’s confirmed count.

How it happened

Unlike COMPAS, this incident combines compromised identity with a software weakness. The ministry says an authorised staff account was impersonated and that a vulnerability in the account-management service was exploited shortly before it was fixed. The public statement does not name the vulnerability, provide a CVE, or explain the precise request sequence.

What was exposed

Officially confirmed fields are pupil first and last name, ÉduConnect identifier, school and class, email if provided, and activation code only for accounts not yet activated. The ministry confirmed data exfiltration. It did not publish a final pupil count by the research cutoff.

What was not in scope

The ministry says accounts already activated by pupils and their guardians were not compromised and could continue to be used safely. It reset codes for unactivated accounts and blocked undistributed or unactivated accounts. The official field list does not include health data or social-security numbers.

What it meant in practice

Because the dataset concerns minors and schools, the main risk is highly credible school-themed phishing aimed at pupils and parents. School, class, identity and activation context can be used to impersonate a school administrator, parent portal or account-support process.

What was done next

The ministry suspended access to the affected service, activated a crisis cell, reset activation codes, blocked unactivated accounts, began strengthening access with MFA, notified ANSSI and CNIL, and filed a complaint. Families were warned to be alert to school-themed fraud.

What later reporting changed

In June 2026, French investigators arrested seven people reported as alleged DumpSec members in a broader investigation. That improves attribution context at campaign level. It does not validate the advertised pupil or report-card counts, and the official student count remains unpublished.

In their words

• the exact number is being evaluated

  Original le nombre exact est en cours d’évaluation

  French Education Ministry, 14 April 2026

• impersonation of an authorised staff member’s account

  Original usurpation d’identité du compte d’un personnel habilité

  French Education Ministry, 14 April 2026

What does this mean?

Phishing

A message or call that imitates a real organisation to get you to hand over a password, a code or a payment.

MFA (multi-factor authentication)

A second proof of identity on top of the password — a code, an app or a security key. Phishing-resistant methods are keys and passkeys.

Exfiltration

Copying data out of a system to somewhere the attacker controls.