Leak at Institut Polytechnique de Paris

On 31 December 2025, Institut Polytechnique de Paris — a cluster of leading French engineering and statistics grandes écoles, including ENSAE — was hit by a student data leak, when a large data set was published on a hacker forum. The exposure was part of a wider wave of French higher-education breaches reported across late December 2025, alongside Université de Lille, Grenoble École de Management and ENSAI.

The leaked archive covered roughly 9,551 students and reportedly amounted to tens of gigabytes of records. Of particular concern, about 4,179 bank account numbers (IBANs) were included, and some coverage reported social-security and national-ID numbers among the data — making this one of the more sensitive of the cluster.

Exposed data categories included:

• Full name (last name, first name)
• Email address
• Postal address
• Phone number
• IBAN (bank account number) for a subset of students

The data appeared on a public leak forum, meaning the records were freely circulating rather than held for private extortion. As of reporting, the precise intrusion vector had not been publicly confirmed and the institution had not published a detailed response, so the incident is treated as ongoing.