Data leak at UPPA Alumni (via AlumnForce)

On 10 April 2026, UPPA Alumni — the alumni network of the University of Pau et des Pays de l'Adour — disclosed that its members' personal data had been exposed in a breach of AlumnForce, the third-party SaaS platform that hosts alumni communities for dozens of French universities and grandes écoles. UPPA is one of the institutions whose data was confirmed compromised.

The incident stems from unauthorized access to the AlumnForce platform itself rather than UPPA's own systems. Reporting attributes the intrusion to a compromised user account, with phishing used to recover the credentials and then extract members' personal information. The full database was subsequently put up for sale on criminal marketplaces, and France's CNIL was notified.

Exposed data for affected members reportedly included:

• First name, last name
• Email address and phone number
• Postal code and city
• Current job title and professional experience
• Career path within the alumni network
• Degree obtained and graduation year
• Skills, career aspirations and salary expectations

Across all 49 affected AlumnForce institutions, roughly 2.7 million profiles were exposed (including more than 1.83 million unique email addresses and over 651,000 phone numbers); UPPA Alumni accounts for a portion of that total. At the time of disclosure the leaked database was being actively marketed for sale, affected institutions were notifying their members, and the incident remained ongoing.