553 Collège Saint-Charles pupils affected by a data leak

On 4 February 2026, Collège Saint-Charles — a private secondary school in Guipavas, near Brest — was identified as one of the schools caught up in the mass data leak affecting the Union Nationale du Sport Scolaire (UNSS), France's national school-sports federation. The 553 pupils registered with the college's Sports Association (Association Sportive) hold UNSS licences, and their records were among the more than 1.5 million student files exfiltrated from the federation.

The breach did not originate at the school itself. It stemmed from a compromise of OPUSS, the UNSS's central licensing platform, which schools across France use to register pupils for inter-school competitions. Attackers gained unauthorised access in November 2025 and exfiltrated an estimated 65 GB of data, which later surfaced on the darknet in early 2026.

For the Saint-Charles pupils, the exposed data falls into the same categories leaked across the UNSS base:

• Full names
• Dates of birth
• School / establishment of enrolment
• UNSS identity photographs
• Insurance information linked to the UNSS licence

Banking and SEPA payment details were not part of the leaked set. The UNSS notified the CNIL and ANSSI, filed criminal complaints over the illegal distribution of the data, disabled direct image-access links, and rolled out emergency security measures including password resets and stronger authentication. Because the affected pupils are minors, the leaked photographs and identity details remain a long-term privacy concern even after the source platform was secured.