Académie de Paris: more than 5,000 contact records and student photos leaked

On 11 April 2026, the Académie de Paris — the regional education authority overseeing Paris's state schools — was the subject of a data leak claimed by a threat actor using the alias Cybernox, who said the breach originated from the compromise of a single Paris secondary school (lycée) tied to the academy's systems. The attacker contacted the breach-tracking site FrenchBreaches to publicise the theft and began circulating the data on cybercriminal forums.

The leaked database covered more than 5,500 people, including 1,701 students — many of them minors — and 3,811 parents or legal guardians.

Exposed data categories included:

• Student identity details: names, gender, nationality, date and place of birth
• School identifiers (INE national student numbers and internal IDs)
• Contact details (phone numbers, email addresses) and full postal addresses
• Academic records: diplomas, specialisations, honours and downloadable official certificates
• Student ID photographs and photo references
• Guardian information: names, multiple phone numbers, emails, postal addresses, number of children, and IBAN bank-account details

Cybernox blamed structural security failures, citing the absence of multi-factor authentication, storage of sensitive data without reinforced protection, and excessive centralisation of personal information. With the data actively distributed, the exposure carries a high risk of targeted phishing, identity theft, social engineering and administrative fraud — concerns heightened by the involvement of minors. No official remediation statement from the academy had been confirmed at the time of reporting.