Threat watch / Breach
French Education Ministry: intrusions hit 25 of its 30 académies
CERT-FR's October status report on the REACTIV operation, published on November 12, 2026, says the French Ministry of National Education reported security incidents in 25 of its 30 académies (regional education authorities) between July and September 2026, with operational impacts of varying severity. The attackers obtained valid credentials, used privileged accounts, looked for new access and exfiltrated directories, application databases and mailboxes, reaching several national services and possibly other State entities through the interministerial network (RIE). No count of people concerned is given. Accounts were reset and services reopened from the start of the school year.
- Sector
- Government & politics
- Way in
- Stolen credentials
- Product or vendor
- None named
- académies (regional education authorities) hit by security incidents, July to September 2026[1]
- 25 of 30
- How it happened
- CERT-FR describes an iterative method: the attackers obtained valid credentials, exploited privileged accounts, looked for new access, then exfiltrated data. They moved laterally to several national deconcentrated services and may have reached other entities through the State's interministerial network (RIE). CERT-FR does not say how the credentials were obtained.[1] Checked 14 Nov 2026
- What was stolen
- Directories, application databases and mailboxes, according to CERT-FR.[1] Checked 14 Nov 2026
- Who was impacted
- 25 of the 30 académies, with operational impacts of varying severity, and several national deconcentrated services. The report gives no number of students, teachers or staff whose data was taken, and the ministry has not published the list of académies, Cyberattaque.org notes.[1][2] Checked 14 Nov 2026
- Threat actor
- Not attributed
Timeline
- From July to September 2026, the Ministry of National Education reports security incidents in 25 of its 30 académies, according to CERT-FR. [1]
- CERT-FR publishes its October REACTIV status report: "Aucune nouvelle violation de données n'a été constatée depuis la parution du rapport de septembre" (no new data breach found since the September report). It says a remediation plan built with ANSSI over the summer led to account resets in several académies, including Nantes and Toulouse, with services reopening from the start of the school year. Remaining work covers hardening administrative access, monitoring data flows and securing some applications. [1]