Collège de France: more than 1,600 researchers, teachers and internal documents leaked

On 14 May 2026, the Collège de France — a prestigious higher-education and research institution in Paris founded in 1530 — was named as the victim of a data leak claimed by a threat actor operating under the alias ChimeraZ. The attacker published around 1,600 researcher and staff profiles together with several hundred megabytes of internal documents drawn from the institution's systems, including its college-de-france.fr and scripta.college-de-france.fr domains.

Reporting points to an internal Nextcloud instance — a file-sharing and synchronisation platform widely used in academic environments — as the source of a large tree of internal files. The exposed data, sampled from the published material, includes:

• First and last names of researchers, teachers and staff
• Professional email addresses
• Research institutes and team affiliations
• Precise office locations and internal phone references
• Directory photographs associated with staff records
• Internal documentation folders and working files

This exposure of detailed contact and organisational data raises a significant risk of targeted phishing and social-engineering campaigns against researchers, teachers and administrative personnel.

At the time of reporting, the exact scope of the access obtained and the full authenticity of the published files had not been publicly confirmed, and there was no official statement from the Collège de France or the French data-protection authority (CNIL). The leak was the smallest of three simultaneous French breaches attributed to ChimeraZ on the same date. Status remains unknown.