Notre-Dame du Grandchamp: thousands of pupils exposed after a cyberattack

On 1 April 2026, Notre-Dame du Grandchamp — a private Catholic school group in Versailles, France, spanning primary, secondary and lycée levels — was added to the dark-web leak site of the NightSpire ransomware gang, which claimed to have stolen roughly 330 GB of data affecting several thousand pupils and employees.

The breach follows NightSpire's classic double-extortion playbook: the operators exfiltrate sensitive files before (or instead of) encrypting systems, then publish a victim listing with a short deadline and threaten to leak or sell the data if no ransom is paid. The intrusion is believed to date from late March 2026, with the public extortion listing appearing on 1 April. The same wave of NightSpire postings also named GMP Group (Singapore) and Ghazi Brothers (Pakistan).

According to the attackers' own listing, the stolen trove includes:

• Students' medical records
• Student personal and academic data
• HR and employee personal data
• Contracts and administrative documents

Because the data spans health information and details on minors, the exposure is especially sensitive, and the records were reportedly offered for sale on cybercriminal channels. As of the disclosure, the incident remained ongoing: the leak listing was active and there was no public confirmation of a ransom payment, full containment, or the school's notification of affected families and authorities.