-
Hackers broke into the Créteil Academy’s systems and stole personal data belonging to students, families, and staff.
-
The stolen records include names, birth dates, phone numbers, grades, and teacher assessments covering two school years.
-
France’s data protection authority, the CNIL, has been notified, and a judicial investigation is now underway.
France’s Créteil Academy has confirmed that hackers broke into its systems and stole personal data. The breach affected students, their legal guardians, and education staff. It happened at the end of July, but the academy shared full details on September 21, after completing more investigations.
According to the academy, its systems suffered what it described as a “fraudulent intrusion.” Hackers then pulled out personal data from student databases and staff directories. The records involved cover the 2025–2026 and 2026–2027 school years. France’s National Cybersecurity Agency, ANSSI, helped with the investigation, according to Clubic.
Other alleged breaches have also involved sensitive records tied to public institutions. In Indonesia, a hacker claimed to have leaked recruitment data from the country’s TNI Military Academy, highlighting how personal information collected by government organizations can become a target for attackers.
What the Hackers Took from School Systems
The stolen records include students’ names, dates of birth, and national student ID numbers, called INE numbers. Personal email addresses, mobile phone numbers, and home addresses were also taken. But the breach went beyond basic contact details.
Hackers also got away with school records. That includes grades and written assessments that teachers made about students. Data belonging to staff members and legal representatives of students were part of the breach too, according to Clubic.
The academy has not said exactly how many people are affected. It has, however, called it a serious breach of personal data confidentiality. When identity details mix with school records, the risk goes beyond simple spam messages. It opens the door to targeted phishing attacks and identity theft.
This breach appears to be linked to a bigger cyberattack on France’s education system. A hacker going by the name ZeroBytes reportedly claimed responsibility for stealing data from several French academic regions back in August, according to French Breaches. However, the full scope of those claims has not been independently confirmed.
Some reports described the claimed dataset as around 43GB spread across roughly 2,500 files, with hundreds of millions of raw records. That number does not equal the number of people affected. The same person can appear across multiple databases. Those figures also come from the attacker’s own claims, not from any official count by the Créteil Academy.
How the Academy and Authorities have Responded
After identifying the intrusion, the academy moved to secure its systems and protect the affected data. The incident has been reported to France’s data protection authority, the CNIL. A judicial investigation is also now underway.
Students, parents, and school staff are being warned to watch out for suspicious emails, texts, and phone calls. The academy reminded everyone that education authorities never ask for passwords, login details, or banking information by email, phone, or SMS. Anyone who receives a message like that should not click any links or hand over personal information.
This is not the first cyber incident to hit French public institutions in 2026. Earlier this year, a separate attack exposed personal information belonging to hundreds of thousands of Education Ministry employees, as reported by 01net. The Créteil breach adds to a growing list of security incidents affecting the public sector in France.
Why This Breach Puts People at Greater Risk
For families and school workers, the real danger is not just the theft itself. It is what criminals can do with the stolen details afterward.
Fraudsters can combine someone’s name, address, phone number, and school information to write messages that look completely real. A fake email using a child’s actual grades and teacher’s name would be very hard to spot as fake. That is what makes this kind of breach more dangerous than a typical password leak.
According to Café Pédagogique, the academy is urging the school community to stay alert. People should verify any unexpected contact that claims to come from the academy or any education authority before responding or clicking anything.
The Créteil Academy breach is a reminder that education systems hold a large amount of sensitive data. That includes not just names and contact details, but also records that reveal a lot about a child’s life and progress in school. When that kind of data ends up in the wrong hands, the consequences can reach far beyond a stolen password.
