French Office for Immigration: massive data leak on the Republican Integration Contract

On 4 April 2026, OFII — the French Office for Immigration and Integration (Office français de l'immigration et de l'intégration), the state agency that runs France's foreign-national reception and integration programmes — publicly confirmed a large-scale data leak affecting people enrolled in the Republican Integration Contract (Contrat d'intégration républicaine, CIR), the integration agreement that is mandatory for foreigners settling permanently in France.

The breach did not stem from a direct intrusion into OFII's own information systems. Instead, a subcontractor — an operator granted access to CIR data — was compromised, allowing an attacker to exfiltrate records. The leak first surfaced on 1 January 2026, when a user advertised a database of roughly 2.1 million lines of OFII data for sale on the BreachForums cybercrime marketplace.

Exposed data categories included:

• Full names
• Contact details (email, telephone, and sometimes postal address)
• Nationalities
• Dates of entry into France
• Residence status and stated motives for residence

OFII stated that no banking data and no passwords were compromised. Given the sensitivity of the affected population, the agency warned recipients to be wary of fraudulent solicitations, particularly phishing attempts impersonating official immigration procedures or demanding payments.

The case is the subject of an ongoing judicial investigation in Paris: two suspects, aged 20 and 17, were charged on 19 March 2026, accused of exploiting a system flaw and then distributing excerpts of the stolen data.