{"id":"educonnect-pupil-data-breach-apr-2026","category":"breach","status":"closed","title":"French education ministry breach exposes pupils’ ÉduConnect identifiers and school details","tldr":"An attacker stole French pupils’ names, ÉduConnect identifiers, schools, classes and some emails and unused-account activation codes. The ministry reset codes. Ask the school for help with blocked accounts and verify unexpected school messages directly.","summary":"France’s education ministry disclosed on 14 April that an attacker had stolen pupils’ information through an account-management service attached to ÉduConnect. A compromised staff account and a service flaw enabled the theft. Exposed information included names, ÉduConnect identifiers, schools, classes, email addresses where supplied and activation codes for accounts not yet activated. The ministry said the flaw had been corrected and accounts already activated at the time of the attack remained safe to use; this assurance did not mean pupils’ personal information was unaffected. It reset access codes for unused accounts and suspended the affected service. Official school guidance subsequently described temporary passwords for accounts blocked as a precaution. No final pupil count, confirmation that stolen copies were recovered, or completed investigation outcome was found in the sources checked through 3 November.","action":"If your child’s ÉduConnect account is blocked, ask their school for a new temporary password and follow its instructions to choose a different password. The ministry says accounts already activated at the time of the attack can continue to be used. Verify unexpected school messages directly with the school before sharing information.","product":"French education ministry’s ÉduConnect pupil account-management service","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["france","education","educonnect","data-breach","children","account-compromise"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Incident de sécurité affectant les données de certains élèves de l'Éducation nationale","url":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-certains-eleves-de-l-education-nationale-504443?trk=public_post_comment-text","by":"French Ministry of National Education","date":"2026-04-14"},{"kind":"news","title":"Cyberattaque contre l’Éducation nationale : des données d’élèves compromises","url":"https://www.aa.com.tr/fr/france/cyberattaque-contre-l-%C3%A9ducation-nationale-des-donn%C3%A9es-d-%C3%A9l%C3%A8ves-compromises/3905581","by":"Anadolu","date":"2026-04-14"},{"kind":"news","title":"Le ministère de l’Éducation nationale victime d’une cyberattaque, les données personnelles d’élèves dérobées","url":"https://www.leparisien.fr/high-tech/le-ministere-de-leducation-nationale-victime-dune-cyberattaque-les-donnees-personnelles-deleves-derobees-14-04-2026-ZUCD4UOLNBEW3F4HUIPQIDUTSY.php","by":"Le Parisien","date":"2026-04-14"},{"kind":"news","title":"L’éducation nationale, une cible vulnérable face aux cyberattaques","url":"https://www.lemonde.fr/pixels/article/2026/04/18/fuites-de-donnees-l-education-nationale-une-cible-vulnerable-face-aux-cyberattaques_6681062_4408996.html","by":"Le Monde","date":"2026-04-18"},{"kind":"advisory","title":"Lettre d’info n°20, 2025–2026 : réinformation de comptes élèves ÉduConnect","url":"https://ien-st-jean-de-maurienne.web.ac-grenoble.fr/sites/default/files/inline-images/kTLXlyTe79O8PBOq025rWPnQ2YSvGICpJENLhIcqUnxxdpSJJA.pdf","by":"IEN Saint Jean de Maurienne","date":""}],"started":"2026-04-14","closed":"2026-04-18","created":"2026-11-03T21:57:30.214Z","updated":"2026-11-03T21:57:30.214Z","cve_notes":[],"timeline":[{"at":"2026-04-18","added":"2026-11-03T21:54:09.841Z","kind":"other","text":"Le Monde reported that the ministry still could not give the number of pupils whose information had been stolen.","url":"https://www.lemonde.fr/pixels/article/2026/04/18/fuites-de-donnees-l-education-nationale-une-cible-vulnerable-face-aux-cyberattaques_6681062_4408996.html","by":"Le Monde","patch":null},{"at":"2026-04-14","added":"2026-11-03T21:54:09.841Z","kind":"other","text":"The ministry said it had suspended the affected service, reset access codes for accounts unused at the time of the attack and blocked accounts awaiting distribution and activation. It notified ANSSI and CNIL, lodged a criminal complaint and began work on two-factor authentication.","url":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-certains-eleves-de-l-education-nationale-504443?trk=public_post_comment-text","by":"French Ministry of National Education","patch":null},{"at":"2026-04-14","added":"2026-11-03T21:54:09.841Z","kind":"disclosed","text":"France’s education ministry disclosed pupil-data theft traced to a compromised authorised staff account in late 2025. An attacker exploited a flaw in a service attached to ÉduConnect before its correction and downloaded records beyond the school initially targeted.","url":"https://www.education.gouv.fr/incident-de-securite-affectant-les-donnees-de-certains-eleves-de-l-education-nationale-504443?trk=public_post_comment-text","by":"French Ministry of National Education","patch":"na"}],"url":"https://hard.fyi/live/educonnect-pupil-data-breach-apr-2026/","json":"https://hard.fyi/api/live?id=educonnect-pupil-data-breach-apr-2026"}