What is confirmed
Posts circulated around 10 October 2026 report that a threat actor claims to have obtained 140,080 profiles across several campuses of the international 42 network. This figure comes from the claims, not an official count of affected people.
The claims mention names, email addresses, profile identifiers, curriculum information and nearly 95,000 references to profile photographs. Image references do not demonstrate that the image files themselves were downloaded.
One reported hypothesis is misuse of a student account followed by automated collection, or scraping. There is no independent confirmation here of that technical sequence, access dates or sample integrity.
What it means
The 42 network spans multiple international campuses. A profile dataset may include old accounts, duplicates or technical references, so a record count is not necessarily the number of distinct affected students.
If genuine course and contact information was exposed, it could assist targeted phishing, fraudulent recruitment offers and impersonation. These are potential risks, not evidence that related fraud has occurred.
A claim, not a confirmed official incident report
As of publication, available information mainly comes from posts relaying an actor's statements and secondary analysis. No official 42 network statement was found confirming the 140,080 profiles, specific data categories or root cause. The figures should be reassessed if verifiable evidence emerges.
Scraping can leverage an account authorised to browse profiles or open interfaces, but that method cannot be conclusively attributed to this event without logs or technical confirmation.
What are the risks for current and former students?
A campus email or curriculum detail can make a fake notice, intranet login request, internship offer or code-download invitation seem convincing. Possession of those details never proves a sender is legitimate.
What to do
Check your own 42 campus's official announcements before acting, and independently confirm unusual requests with the relevant team.
Avoid unexpected login links or attachments, especially purported password resets, recruiting messages or requests to install software.
Use unique passwords, enable multifactor authentication where available and report unfamiliar sessions or account activity.
If you receive a suspicious message, check its content or link using a security tool without unnecessarily disclosing secrets or personal documents.
Use the related SecurCheck tool, then confirm important decisions with an official source.
