Leak at the French Office for Immigration and Integration

On 5 January 2026, the French Office for Immigration and Integration (OFII) — the public agency that manages the reception and integration of immigrants in France — confirmed a data breach affecting personal records of foreign residents. The compromise was tied not to OFII's own information systems but to a subcontractor, a private provider running the language and civics courses required under the republican integration contract (CIR).

A threat actor advertised the stolen data on the BreachForums cybercrime forum around 1 January 2026, posting sample files and offering a database of roughly 2.1 million records in JSON format. OFII's director-general disputed that scale, stating that the verified initial dump concerned fewer than 1,000 individuals; the full extent remained under investigation.

The exposed data categories included:

• Full name, sex, date and place of birth
• Postal address, phone number and email
• Nationality and languages spoken
• Family situation, family number and children's dates of birth
• Type/nature of residence permit, processing prefecture and decision date

French authorities opened an investigation and arrested two suspects, aged 17 and 20, who were charged with fraudulent access to an automated data-processing system and related offences. As the data controller, OFII remains exposed to potential GDPR enforcement by the CNIL. The investigation into the scope of the leak and possible accomplices was ongoing.