14,753 people affected by a claimed leak at EPITA

On 15 February 2026, EPITA — a French private engineering school specialising in computer science and cybersecurity, part of the Ionis Education Group — was named in a post on the BreachForums cybercrime forum advertising a database allegedly stolen from the institution. The threat actor group Lapsus$ claimed the data, which was offered for sale for roughly $100.

The claim covers 14,753 individuals, described as current and former students and staff. According to the listing and analysts who reviewed it, the data was compatible with large-scale scraping of academic profiles rather than a confirmed system intrusion; the precise compromise method was not disclosed. The leak follows a similar incident in January 2026 targeting Epitech, another Ionis Education Group school.

The data categories described in the claim include:

• Full names and nicknames
• Email addresses (personal and @epita.fr accounts)
• Graduation years
• Profile pictures
• Specialisation metadata (e.g. Cybersecurity, AI)

The exposure is mainly identity and contact data rather than financial or authentication credentials, but security researchers warned that the combination of names, graduation years and specialisations creates a high-quality target list for spear-phishing and social-engineering campaigns. At the time of reporting the dataset was being actively offered for sale, and the figures remained a seller's claim that EPITA had not publicly confirmed.