422 email addresses exposed in a claimed data leak at Union-prof.asso.fr

On 14 May 2026, Union-prof.asso.fr — the website of the UPPCTSC (Union Professionnelle des Professeurs, Cadres et Techniciens du Secrétariat et de la Comptabilité), a professional association founded in 1919 that works in vocational training, accounting and administrative certification alongside partners such as the GRETA network and CNED — was named in a data leak published on a cybercrime forum.

The leak was claimed by the threat actor ChimeraZ, who released roughly 11,000 documents totalling around 8.6 MB in JSON and PDF formats. The published sample consisted mainly of administrative conventions tied to training establishments and GRETA centres across several French académies (Lille and Dijon among them). The attack vector was not disclosed, and the breach was part of a coordinated batch in which ChimeraZ simultaneously claimed leaks against EFC Formation and the Collège de France.

Exposed data categories reportedly included:

• Administrative convention documents and partnership agreements
• GRETA training-centre information, institution names and addresses
• Professional email addresses (including Education Ministry contacts)
• Timestamped download/access logs

As of disclosure, neither the full authenticity of the data nor the exact point of compromise had been publicly confirmed by the association. The leaked conventions, administrative correspondence and professional email addresses raise a clear risk of targeted phishing against training-organisation staff and administrative managers.