EFC Formation: a massive leak exposes 60,000 administrative documents and 49,000 students

On 14 May 2026, EFC Formation — the École Française de Comptabilité, a French distance-learning institution specializing in accounting, management, HR and secretarial training — was named as the victim of a large data leak attributed to the threat actor ChimeraZ, who published the stolen data on a cybercrime forum.

The leak came in two releases. A first archive of roughly 1.3 GB exposed data on approximately 49,000 students, while a second, much larger set of 41 GB containing 60,683 PDF documents was offered for sale. The breach was part of a wider ChimeraZ campaign that hit several French organizations within 48 hours. The intrusion method, motive (resale, extortion or ideological exposure) and exact origin of the leak were not established publicly.

Exposed data categories reported include:

• Student names, addresses, dates of birth, enrollment numbers and program details
• Training records, signed forms, certificates and invoices
• Bank identity statements (RIB) and IBANs, including accounts via Monabanq
• Administrative and pedagogical documents

The combination of personal identifiers with banking details creates a significant risk of identity theft and account fraud. As of the disclosure date, neither EFC Formation nor the CNIL had issued a public statement; the institution had not confirmed the authenticity of the files or the exact origin of the breach, and the GDPR 72-hour notification deadline fell on 17 May 2026.