France data breaches in 2026: tax office, schools and AFPA explained
A sourced timeline of DGFiP, education and AFPA incidents, separating the actual scope and practical checks for each case.
Read the analysisSECURCHECK · CYBER NEWS
Public services and institutions
Verified incidents affecting government services, education and public bodies, with practical next steps.
PUBLIC SERVICES · VERIFIED GUIDE
Read the overview Data breaches in France: follow the facts
A sourced overview of tax, education and training incidents, with a clear distinction between confirmed exposure and claims.
Monthly overviewCyber incidents in September 2026
AFPA cyberattack: up to 1.7 million people potentially affected
A potential extraction from a third-party accommodation system is being investigated. What the preliminary figure means and how to spot follow-on scams.
Read the analysis
French tax office breach: what data was extracted for 678,000 users?
Unauthorised access to DGFiP systems exposed tax and property data; personal impots.gouv.fr accounts were not compromised.
Read the analysis
French education ministry: July intrusion and staff data exposure
An impersonated professional account gave access to a staff training system. The ministry later reported published data and an ongoing investigation.
Read the analysis
EduConnect: which student details were exposed in April 2026?
Names, EduConnect IDs, school and class appear in the official notice. Already activated accounts are distinguished from exposed activation codes.
Read the analysis
COMPAS breach: around 243,000 French education staff affected
France's education ministry reports exfiltration from COMPAS following impersonation of an external account in March 2026.
Read the analysis
France Travail: what the 2023 vendor breach exposed
A historic Pôle emploi incident involved a vendor and job seekers' details. It must not be confused with the 2024 or 2025 breaches.
Read the analysisWe distinguish confirmed facts from claims and update articles when primary sources publish new information. These reports are not a real-time incident feed.