Leak at ESPCI

On 26 February 2026, ESPCI Paris — a prestigious engineering, physics and chemistry school within PSL University — disclosed a personal data breach affecting its academic community. According to the school's IT department, a defect in access controls allowed unidentified actors to harvest the institution's internal directory.

The breach did not involve ransomware or destructive malware; it stemmed from a misconfiguration that left directory records improperly protected. Crucially, account passwords were not exposed. The exposed information concerned students, staff, contractors, partners and external personnel listed in the directory.

Categories of data reported exposed include:

• Title, usual first and last name, professional email and, where provided, personal email
• Usernames (but not passwords)
• Position, assignment and access permissions to services and premises
• Photos (unless restricted to badge use), and mailing-list subscriptions
• For students: course enrolments
• For staff: employer, field of activity (BAP, CNRS and CNU section), and for in-house staff their corps and contract end date
• For service providers, partners and external personnel: employer and socio-professional category

ESPCI notified its entire community of account holders and reported the incident to France's data protection authority (CNIL) under Article 33 of the GDPR. The IT department said it would reinforce its security measures to prevent a recurrence. No exact number of affected individuals has been published.