Roubaix: the Kiosque famille suspended after a data leak concerning schoolchildren

On 12 May 2026, the town of Roubaix — a city of around 100,000 residents in northern France — disclosed a security incident affecting its "Kiosque famille," the online platform run by the municipal Education service for school meals, childcare and leisure-centre bookings. The breach was traced to the evening of Saturday 9 May.

According to the city, two legitimate user accounts were compromised and exploited by a third party to gain unauthorised access to the platform, resulting in a data leak. The exposure concerned the records of 165 children enrolled in Roubaix schools, along with details about their families. The municipality stressed that no banking or financial information was involved.

Exposed data included:

• Children's first and last names
• Parents' first and last names and addresses
• Family situation
• Children's school assignment

In response, Roubaix immediately took the Kiosque famille offline as a precaution and alerted the French national cybersecurity agency (ANSSI), which confirmed the leak. The city filed a complaint, began notifying the data protection authority (CNIL) via its regional data protection officer, launched technical investigations, and ordered the software vendor to fix the exploited vulnerability. The 165 affected families were to be contacted individually, and the service remained suspended pending full security restoration, with meals still available without advance reservation in the interim.