Leak at École Nationale de la statistique et de l'analyse de l'information

On 31 December 2025, École Nationale de la statistique et de l'analyse de l'information (ENSAI) — a French grande école of statistics and data science based in Bruz, near Rennes, and part of the INSEE/GENES network — was hit by a data breach claimed by an attacker who published the stolen files online.

The threat actor claimed to have exfiltrated around 21 GB of data and released it publicly, provocatively framing it as a leak from a statistics school. The exposure affected approximately 3,900 students. The breach was logged in French retrospectives of 2025 data leaks and relayed on social media.

Data reported as exposed includes:

• First and last names
• Email and postal addresses
• ID photographs
• Phone numbers
• Partial payment card numbers, CVV and expiration dates
• Enrolment records and evaluation results

The incident remains unresolved at the time of reporting, with the leaked data circulating publicly. French authorities (ANSSI) have cautioned that many 2025 breach claims were unverified or recycled, so the full scope of this particular leak has not been independently confirmed.