Service Civique: contacts from public and association organisations published after a cyberattack

On 2 May 2026, Service Civique — France's public agency running the national civic-service programme (service-civique.gouv.fr) — was reported to have suffered a personal-data breach, after a database attributed to the platform was published on a cybercrime forum by a threat actor using the handle 0xBAADF00D. The Agence du Service Civique said it detected the incident on 6 May 2026 and that it affected the online training platform used by the organisations hosting Service Civique volunteers.

The compromised platform was operated under contract by the agency's service providers, and the exposed data centred on the contacts and referents at accredited host structures rather than on complete volunteer files. According to the agency's notification and French reporting, the unauthorised access covered:

• Civil-identity data (title, first name, last name)
• Email addresses
• Full postal addresses (for some accounts)
• Phone numbers (for some accounts)
• Host-organisation details, including business/structure names and accreditation numbers

The exact number of affected records has not been publicly detailed. Security commentators warned that the leaked contact data could be used to mount highly credible phishing campaigns against the affected public bodies and associations.

The Agence du Service Civique confirmed the incident, launched technical investigations as soon as it was discovered, notified the individuals potentially affected, reported the breach to France's data-protection authority (CNIL) under the GDPR, and filed a criminal complaint. The investigation remains ongoing.