National Gendarmerie: nearly 60,000 gendarmes exposed after the Resana leak was republished

On 26 April 2026, the National Gendarmerie — France's military police force — saw the personal data of roughly 59,000 of its members put back into circulation by a hacker using the alias Angel_Batista. The actor presented the release not as a fresh intrusion but as the republication of a dataset already extracted from Resana, the French government's inter-ministerial collaborative platform.

The underlying data was obtained through scraping of Resana, carried out in 2025 before the platform enforced two-factor authentication. According to reporting on the broader campaign, attackers reached the platform using compromised user credentials rather than any technical vulnerability, allowing large-scale exfiltration of agent directories.

The exposed records reportedly include:

• First and last names
• Landline and mobile phone numbers
• Personal and professional email addresses
• Job titles and administrative postings
• User identifiers, account status and connection timestamps
• Language preferences, profile avatars and device-related technical information

The republication was staged as a symbolic act, tagged #FREEHEXDEX, in reaction to the recent arrest of the cybercriminal known as HexDex, detained on 20 April 2026 in the Vendée. Because the dataset has been re-disseminated publicly, it heightens the risk of phishing, identity fraud, social engineering and organisational mapping of French law enforcement. The actual volume compromised via Resana was never officially confirmed by the authorities, and the data continues to circulate.