Skip to content
CBCyber Breaches
Search

Incidents from

2026

Data breachRansom paid

Instructure Canvas LMS ShinyHunters breach (2026)

ShinyHunters exploited Canvas's Free-For-Teacher account programme to exfiltrate 3.65 TB of data spanning approximately 275 million users across nearly 9,000 schools — names, email addresses, student IDs, and some private messages between students and teachers. Instructure reportedly paid the ransom and the data was destroyed.

Victim
Instructure (Canvas LMS)
Loss
$10.0M
Records
275.0M
OtherUnknown

Leak at Lilagora (via AlumnForce)

First and last name, email address, phone number, postal code, city, current job title, career aspirations, professional experience, career path within the network, degree obtained, year, skills

Victim
Lilagora
OtherUnknown

Leak at Alumni Université de Strasbourg (via AlumnForce)

First name, name Email address Phone number Postal code, city Current job title Career aspirations: Sectors, compensation sought, countries or cities + postal codes sought, position sought, experience level Professional experience: month and year, job title, company, city Career path within the network: degree obtained in year, name of the degree) Skills

Victim
Alumni Université de Strasbourg
Data breachUnknown

109,302 CMF members: data leak claimed

The 109,302 members of the Confédération Musicale de France (CMF) are reportedly affected, according to the claim. According to the elements provided, a batch put up for sale by the actor HexDex would contain the…

Victim
Confédération Musicale de France (CMF)
Records
109.3K
Data breachUnknown

Data leak at Mingat

Mingat customers are affected by a data leak confirmed by the company. The firm, specialized in vehicle rental, informed its customers of a security incident that…

Victim
Mingat
Data breachUnknown

Data leak at Vatel Capital

Vatel Capital customers were informed by email on 9 March 2026 of an accidental file exposure. The asset management company indicates that the incident occurred between 21 February and 3…

Victim
Vatel Capital
OtherUnknown

Leak at ESPCI

Title, usual first and last name Professional email, and possibly personal email if provided Identification data: username, but not the password Position and assignment Photo, unless it had been indicated it should only be used for the badge Access permissions to services and premises Mailing list subscriptions For students: course enrolments For staff: employer, field of activity (BAP, CNRS and CNU section) For staff employed by the in-house body: corps, contract end date For service providers, partners and external personnel: employer, socio-professional category

Victim
ESPCI
OtherUnknown

Leak at FFCK and Paddle Sports

Last name, First name Gender Date of birth Club name, Departmental committee name, Departmental committee code, Regional committee name, Regional committee code Paddle color, Licence type

Victim
FFCK and Paddle Sports
OtherUnknown

Leak at the French Office for Biodiversity

Last name, first names Date and place of birth Postal address Landline and mobile phone numbers Nationality Email address Hunting licence number Information relating to the application, processing or examination of the hunting licence Listing in the national file of persons prohibited from acquiring and holding firearms Summons, dates, attendance and result

Victim
French Office for Biodiversity
OtherUnknown

Leak at 11 real estate agencies

1.2 million documents, 500+ GB SCI Fonciere de la tourelle Aix La Duranner Immo MARTEAU IMMOBILIER (Orpi) AFG IMMOBILIER OC INVESTISSEMENT TRENTA IMMOBILIER BLG PATRIMOINE SB IMMOBILIER SUN IMMOBILIA IMMOVALIE SAS Immo Name, first name Postal address Login and password Email address Rent receipt, invoice Phone number Contract data IBAN Maintenance logs Marketing campaigns Financial reports Minutes of general meetings E·V·E·R·Y·T·H·I·N·G

Victim
11 real estate agencies
OtherUnknown

Leak at Guiot de Bourg

90,000 customers Last name, first name Email address Hashed password Date of birth Newsletter signup IP Website Authorized amount Payment terms Guest status Deleted account (😒) Password renewal token Secret key

Victim
Guiot de Bourg
OtherUnknown

Leak at Panorama Banques

2,340,422 customers Last name, first name Nationality Postal address Email address Phone number Marital status Income, current loans, rent Bank Account opening date Owner/tenant status Profession, type of employment contract

Victim
Panorama Banques
OtherUnknown

Leak at Orpi

IBAN Last name, first name Rent receipt Postal address Extranet username Extranet password in plain text Tenant

Victim
Orpi
OtherUnknown

Leak at ENSAM

First name, last name Social Security number Scholarship award decision and amount Start and end date of sick leave

Victim
ENSAM
OtherUnknown

Leak at Eurail

First name, last name Date of birth Email address Postal address Phone number Passport number, issue and expiration date

Victim
Eurail
Data breachUnknown

2.1 million: data leak at OFII / ANEF

People who used the OFII / ANEF "Étrangers en France" portal are affected: the leak is confirmed and covers around 2.1 million rows of data. This portal is used by…

Victim
OFII / ANEF ("Étrangers en France" portal – French Ministry of the Interior)