Leak at Hauts-de-France high schools

On 10 October 2025, the Hauts-de-France region — which manages the IT systems of public high schools across northern France — disclosed a major cyberattack that paralysed roughly 80% of its some 269 public secondary schools. Internet and network access in the affected establishments was suspended as crisis teams isolated and cleaned compromised servers, leaving staff to handle attendance, school catering and student-grant payments manually for weeks.

The intrusion was a ransomware attack attributed to the Qilin group, which quickly claimed responsibility on its dark-web leak site. Qilin asserted it had exfiltrated more than one terabyte of data from the schools' servers before encrypting systems. The region later acknowledged that unauthorised access to personal data had occurred in at least some establishments.

Exposed and claimed-stolen data reportedly included:

• Copies of national ID cards and passports
• Students' CVs
• Academic transcripts and grade records
• School disciplinary and incident reports
• Personal details of pupils and staff

The region filed a criminal complaint, notified France's data-protection authority (CNIL), and engaged Orange Cyberdéfense to support the response. Administrative tools were restored in nearly all schools by early November 2025, but full recovery of pedagogical systems remained ongoing months later. Staff and families were advised to change passwords and watch for identity-theft and phishing attempts.