Crous: 770,000 students affected by a massive leak

On 24 March 2026, Crous — France's network of regional student-services agencies, coordinated nationally by Cnous — confirmed a cyberattack that exposed personal data on 774,000 students and former students. The breach was discovered on 23 March 2026 and stemmed from the compromise of mesrdv.etudiant.gouv.fr, the platform used to book appointments with Crous social and housing services.

The attacker extracted appointment records accumulated over roughly a decade, then claimed and began leaking the data online. The threat actor group DumpSec took credit, claimed to hold around 200 GB (some 1.9 million appointment records), and published a sample of about 5,000 lines on cybercriminal forums. The same group has been linked to other recent French education-sector breaches.

The exposure varied by individual:

• 635,000 people had basic identity data leaked — name, surname, email address — together with appointment details.
• 139,000 people were more severely affected: file attachments stored in their Crous dossiers were stolen, including identity documents such as copies of ID cards and passports, exposing them to a higher risk of identity theft, targeted phishing and administrative or financial fraud.

Cnous acknowledged the breach publicly and confirmed the victim counts. The incident was part of a wider wave of attacks on French educational institutions disclosed around the same time.