25,000 students affected by a claimed data leak at Penninghen

On 5 March 2026, Penninghen — a Paris-based school of graphic arts, interior architecture and art direction — was named in a claimed data breach after a threat actor advertised its database for sale on underground breach forums. The actor, operating under the alias st0jke, said they had compromised the school's internal platform and exfiltrated roughly 14 GB of data.

The leak reportedly covers about 25,000 students, along with information on their parents and the school's administration. The same actor has been linked to claimed intrusions at several other French higher-education institutions during the same period, with stolen datasets surfacing for sale on multiple darknet forums.

According to the listing, the exposed data included:

• Complete personal information (PII) for roughly 25,000 students and their parents
• 7,868 photos of students and teachers
• 5,363 sensitive documents (IBANs/RIBs, national ID cards, passports, school certificates, criminal-record extracts)
• 18,360 student invoices and expense records
• Administrator accounts and connection logs
• The platform's complete source code (~47,000 files)

The scale and nature of the exposed data — banking details and identity documents in particular — leave affected individuals at risk of identity theft, bank fraud and targeted phishing. As of the disclosure date, no public statement from the school had been reported and the breach remained unconfirmed by the institution, so the status is unknown.