3 million students: claimed data leak at UNSS #2

On 28 February 2026, the UNSS — the Union nationale du sport scolaire, France's national school sports federation, which manages licences for middle- and high-school students — was named in a claimed data leak affecting children aged 11 to 18. The threat actor group DumpSec advertised the stolen dataset for sale on dark-web channels, claiming roughly 65 GB of data and about 1.5 million student identity photos.

According to reporting, the attackers gained unauthorised access to OPUSS, the federation's online management platform, and exfiltrated data that had apparently been accessible since around November 2025; the breach only became public in February 2026.

Exposed data reportedly included:

• First and last names
• Dates of birth
• Postal and email addresses
• Schools attended and membership/licence numbers
• URLs pointing to students' identity photos

The UNSS confirmed the intrusion and said it had rendered the photo-access links inoperable. The federation notified the French data protection authority (CNIL) and the national cybersecurity agency (ANSSI), filed a criminal complaint, and rolled out remediation measures including deletion of inactive accounts, password resets, stronger authentication and fresh penetration testing.