AlumnForce: 2.7 million students and graduates exposed

On 6 April 2026, AlumnForce — a French SaaS provider whose platform manages alumni networks and professional communities for universities, business schools and engineering schools — was reported to be at the centre of a massive data breach. A threat actor advertised a database of roughly 2.7 million profiles for sale on criminal forums, drawn from the alumni directories of dozens of institutions.

Because AlumnForce hosts data on behalf of many schools, the leak spread across some 49 establishments — among them Sciences Po, HEC Paris, École Polytechnique, the Université de Strasbourg and the Université de Bordeaux — with records reportedly spanning decades of student and graduate history. Multiple institutions subsequently confirmed they were affected.

The exposed data was unusually rich, going well beyond contact details. Reported categories include:

• Names, email addresses (around 1.83 million unique) and phone numbers (around 651,000)
• City, postal code and current workplace location
• Education history (programmes, degrees, graduation status)
• Professional details (current role, employer, work experience)
• Job-search preferences (desired positions, contract types, target sectors) and salary ranges
• Account metadata such as registration and last-update dates

The sample data was reported to include the personal and professional details of more than a thousand French public figures and current government officials, raising the sensitivity of the exposure. The incident remains ongoing, with the data circulating for sale and affected institutions notifying their communities.