French education ministry breach exposes pupils’ ÉduConnect identifiers and school details
An attacker stole French pupils’ names, ÉduConnect identifiers, schools, classes and some emails and unused-account activation codes. The ministry reset codes. Ask the school for help with blocked accounts and verify unexpected school messages directly.
If your child’s ÉduConnect account is blocked, ask their school for a new temporary password and follow its instructions to choose a different password. The ministry says accounts already activated at the time of the attack can continue to be used. Verify unexpected school messages directly with the school before sharing information.
What’s happening
France’s education ministry disclosed on 14 April that an attacker had stolen pupils’ information through an account-management service attached to ÉduConnect. A compromised staff account and a service flaw enabled the theft. Exposed information included names, ÉduConnect identifiers, schools, classes, email addresses where supplied and activation codes for accounts not yet activated. The ministry said the flaw had been corrected and accounts already activated at the time of the attack remained safe to use; this assurance did not mean pupils’ personal information was unaffected. It reset access codes for unused accounts and suspended the affected service. Official school guidance subsequently described temporary passwords for accounts blocked as a precaution. No final pupil count, confirmation that stolen copies were recovered, or completed investigation outcome was found in the sources checked through 3 November.
- What
- Breach
- Affects
- French education ministry’s ÉduConnect pupil account-management service
- Fixed in
- Nothing to patch
- Since
- 14 Apr 2026
- Closed
- 18 Apr 2026
Timeline
- Update
Le Monde reported that the ministry still could not give the number of pupils whose information had been stolen.
- Update
The ministry said it had suspended the affected service, reset access codes for accounts unused at the time of the attack and blocked accounts awaiting distribution and activation. It notified ANSSI and CNIL, lodged a criminal complaint and began work on two-factor authentication.
- Made publicNothing to patch
France’s education ministry disclosed pupil-data theft traced to a compromised authorised staff account in late 2025. An attacker exploited a flaw in a service attached to ÉduConnect before its correction and downloaded records beyond the school initially targeted.
Sources
- Incident de sécurité affectant les données de certains élèves de l'Éducation nationaleFrench Ministry of National Education · 14 Apr 2026
- Cyberattaque contre l’Éducation nationale : des données d’élèves compromisesAnadolu · 14 Apr 2026
- Le ministère de l’Éducation nationale victime d’une cyberattaque, les données personnelles d’élèves dérobéesLe Parisien · 14 Apr 2026
- L’éducation nationale, une cible vulnérable face aux cyberattaquesLe Monde · 18 Apr 2026
- Lettre d’info n°20, 2025–2026 : réinformation de comptes élèves ÉduConnectIEN Saint Jean de Maurienne