Data leak at AgroParisTech

On 4 January 2026, AgroParisTech — France's leading public graduate school of agronomy, food and environmental sciences — was hit by a cyberattack affecting its information systems, which the institution detected on 5 January and publicly disclosed in a press release on 8 January.

An attacker claimed responsibility for the intrusion and asserted that around 211 GB of highly sensitive data had been exfiltrated. Sample files circulated alongside the claim pointed to access reaching administrative and HR servers, exposing data on staff, students and external contributors.

The exposed data reportedly included:

• Complete personal information sheets with identity photos, postal addresses and handwritten signatures
• Payroll documents and financial notifications
• SQL database extracts with names, first names, institutional emails (@agroparistech.fr) and personnel statuses (staff, external contributor, etc.)
• VPN keys and email backups that could enable further intrusion

On detection, AgroParisTech disconnected its information systems, brought in external security experts and notified the relevant authorities, including ANSSI and the CNIL. A criminal complaint was filed with the Massy police on 6 January 2026. Affected individuals were notified individually where their personal data was confirmed compromised. As of mid-January the institution stated the incident was closed and that systems were being progressively and securely restored; those responsible had not been clearly identified.