Loading story…
The ZeroBytes group has claimed it stole roughly 43 GB of data from France’s Ministry of National Education and is offering part of the alleged haul for sale on a cybercrime forum. Reporting on the listing says the dataset purportedly contains 346,178,591 raw lines of data, including school system exports, staff exports from 33 academies, and two LDAP directory dumps with network account names and hashed passwords. The claimed records reportedly map to about 4.35 million staff identifiers and 1.22 million students after deduplication, with potentially sensitive information including names, addresses, school records, administrative data, and monitoring records tied to vulnerable or at-risk students.
French authorities have not confirmed the full scope of the breach, and the sale claim remains unverified because no sample data was publicly released. The ministry said it is still conducting technical analysis, but the incident appears connected to a late-July intrusion in which attackers accessed employee data through a compromised professional account before access was detected and blocked on July 26. The ministry has filed a complaint and is coordinating with CNIL and ANSSI on response and security reinforcement, while the alleged LDAP dumps raise concern that offline cracking of password hashes could enable continued unauthorized access if affected credentials remain valid.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
On August 17, 2026, a sale listing attributed to ZeroBytes was observed offering a partial database allegedly taken from the French Ministry of Education. The post claimed 346,178,591 raw lines of data, including records tied to 4,350,358 staff identifiers and 1,224,291 students, though the claim remained unverified.
The French Ministry of National Education said the unauthorized access tied to the earlier intrusion was identified and blocked on July 26, 2026. The ministry later said it filed a complaint and began working with CNIL and ANSSI on security reinforcement measures.
The French Ministry of National Education dated an earlier intrusion to the night of July 25, 2026, saying attackers gained access by impersonating or misusing a professional account. The compromised system exposed professional and personal data relating to ministry employees, including data dating back to 2001.
A threat actor using the alias ZeroBytes claimed to have breached Éducation Nationale and dated the intrusion to July 15, 2026. The actor said the stolen data included school system exports, staff exports from 33 academies, and two LDAP directory dumps with account names and hashed passwords.
At the end of July 2026, the administration reported an intrusion in its systems affecting a significant number of ministry agents. It said at the time that the compromised system did not contain banking data, passwords, or student-related data.
Following ZeroBytes' claim of stealing 43 GB of ministry data, the French Ministry of National Education said it was conducting technical analysis to determine the exact nature and extent of any exfiltrated data. The ministry said it would notify affected individuals, or legal guardians for students, if the leak is confirmed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
French education authorities disclosed two significant breaches affecting both public and Catholic school administration systems. The Ministry of National Education said its `Compass` platform, used to manage trainee teachers in primary and secondary education, was compromised after a user reportedly opened a fraudulent email attachment and had credentials stolen. The incident exposed data on about **243,000 people**, including identity and contact details, absence periods, and the identities and professional phone numbers of tutors, though the ministry said no health data was involved. ANSSI was brought in, a crisis cell was opened, and the ministry announced a security plan centered on **multi-factor authentication**, stronger data segmentation, and reduced application exposure. Separately, the Secrétariat général de l’enseignement catholique reported a cyberattack on its management application for nursery and elementary schools that affected about **1.5 million people**. Unauthorized access exposed identification data for application users and contact information for students, families, and teachers, including names, postal and email addresses, phone numbers, and dates of birth, increasing the risk of phishing. The organization said it secured access, suspended affected services, notified authorities including the French Ministry of Education, and engaged specialist responders, while a forum user calling themselves **"Ryolait"** allegedly offered the stolen database for sale starting at **$2,000**. The incidents add to mounting concern over weak security in the education sector, which ANSSI has described as a frequent target of opportunistic attacks.
Jun 29, 2026
French police arrested an 18-year-old suspected member of the ZeroBytes hacking collective, known online as **“ChatNoir,”** in connection with the compromise of France’s Directorate General of Public Finances (DGFiP). Prosecutors said the suspect was arrested on August 18, formally placed under investigation on August 20, and remanded in pretrial detention. A second suspect, younger than 16, was questioned and released; investigators retained that person’s computer equipment for forensic examination. The DGFiP breach exposed data on more than 678,000 individuals and businesses. Investigators believe the intrusion relied on impersonating internal staff accounts with excessive permissions rather than exploiting a technical vulnerability. DGFiP is urgently deploying USB security tokens to strengthen multifactor authentication as authorities pursue other possible ZeroBytes members. More than 1,200 affected people have joined a GDPR damages action.
Sep 5, 2026
Security researchers reported a large, publicly exposed database on an open cloud server containing **tens of millions of French citizen records** aggregated from at least five prior breaches, including voter data, healthcare entries, CRM contacts, financial profiles (including **IBANs/BICs**), and vehicle-related information. The dataset appears to have been compiled to increase resale value and enable identity cross-linking, elevating risks of **phishing, fraud, and identity theft**. Separately, Australia’s **Victorian Department of Education** notified parents that an unauthorized party accessed a student database containing names, school names, year levels, school-issued email addresses, and **encrypted passwords**, prompting a forced password reset and temporary account access disruption; the department stated more sensitive fields (e.g., home addresses, phone numbers) were not exposed and investigators had not confirmed public release. In another unrelated report, researchers questioned the veracity of a newly claimed **PayPal** breach, assessing a ~100,000-record credential “combolist” as likely **outdated infostealer-log data** rather than evidence of a fresh PayPal compromise, noting PayPal’s prior refutation of similar claims and the practical barriers posed by MFA.
Jun 29, 2026