Data leak at Université de Lille

On 29 December 2025, Université de Lille — one of France's largest public universities, with more than 80,000 students — was named on the BreachForums cybercrime marketplace, where a threat actor operating under the recycled LAPSUS$ name advertised a database of 7,244 student records. The leak was part of a wider wave of attacks against French higher-education institutions in late December 2025, which also hit Grenoble École de Management, École Polytechnique and ENSAI.

The exposed dataset appears to originate from an internship/placement database tied to the university's IUT Informatique (computer-science institute), with the records reportedly extracted around August 2025 before being disclosed publicly months later. The university had not issued a public response at the time the listing surfaced.

Exposed data categories included:

• Internal student identifiers (NIP)
• First and last names
• Dates of birth
• Postal addresses
• Personal and institutional email addresses
• Phone numbers
• Administrative information

The combination of dates of birth with contact details and civil-status information notably raises the risk of identity theft and targeted phishing, since the records lend credibility to fraudulent messages impersonating official university communications.