French Éducation nationale agent-training system breach (July 2026)

The earlier entry recorded that France's Direction générale des Finances publiques confirmed intrusions in June and July 2026 using stolen credentials of a DGFiP agent and of an authorised third party, and that only the attacker's sale listing (two months later) established that data on 678,000 individuals and businesses had gone. The delta is that the same actor's footprint now reaches a second French government system, and that the ministry involved has put its own words to what was taken.

The Education Ministry link. ZeroBytes claimed on 18 August to have absorbed 346 million raw lines from the Ministry of National Education some weeks earlier, asserting it had been detected but not cut off. Contacted directly by franceinfo, the minister's office confirmed the claim corresponds to the fraudulent intrusion into one of its information systems that the ministry had already announced on 31 July (franceinfo, 2026-08-18). The linkage of the two thefts to one actor comes from French media reporting rather than from any authority, and this entry carries it at that weight.

What the ministry itself said about the data is the materially new fact. The information at risk concerns ministry staff who worked in an académie since 2001 (identity elements and professional information, status and functions) and for a portion of them the ministry adds contact details, postal address, telephone number and the French social-security number. It also draws a boundary: that information system contains no banking data, no passwords and no student data. On the actor's separate assertion to hold student records, the ministry's position is that its technical examination continues, pending, not a denial. The social-security-number exposure is a detail the earlier DGFiP-only coverage did not carry, and it changes the downstream risk for the affected staff from contactability to identity fraud.

The third breach, and why it is not part of this story. In the same period France's consumer-protection directorate disclosed a separate incident: "Un accès frauduleux à un compte professionnel a permis à un cybercriminel de récupérer des fichiers contenant 3 millions de numéros de téléphone, dont 600 000 inscrits sur Bloctel", a fraudulent access to a professional account let a cybercriminal retrieve files containing 3 million phone numbers, 600,000 of them registered on the Bloctel telemarketing opt-out list (DGCCRF, 2026-08-12). DGCCRF states no personal data such as name or address was disclosed, that the compromised account was blocked as soon as the incident was noticed and all professional accounts subsequently reviewed, and that the Bloctel database itself was not compromised.

It is worth being explicit about what is not established, because the opposite was circulating: no source names an actor for Bloctel, and none ties it to ZeroBytes. The "same hacker" claim in international coverage traces, through its own hyperlink, to a French broadcast report that discusses only the tax authority and the Education Ministry (OCCRP, 2026-08-20). Nor does any source describe one investigation spanning all three; the national anti-cybercrime unit is placed on the DGFiP breach.

Triage: across the intrusions where a mechanism is stated at all, the access is a legitimate account used by someone who should not have it, an agent's and an authorised third party's credentials at DGFiP, a professional account at DGCCRF. There is no malware, no exploited vulnerability and no CVE anywhere in this cluster, so nothing here produces a detection signal on an endpoint. The discriminator is behavioural on the identity plane: a valid account performing bulk record retrieval at a volume and rate no human workflow generates, from a session that is otherwise unremarkable. The DGFiP case established the harder half of the problem, its own post-intrusion access reviews, run when the accounts were cut, did not reveal that data had already been taken. The Education Ministry case adds the same shape from the other side: the actor's claim to have been detected without being evicted is unaddressed by the ministry's published statements.

The delta here is operational, not technical. The Ministry of National Education's precautionary decision to cut network and mailbox access for affected académies, taken after the intrusion this entry already tracks, is still causing real disruption to the 2026 school-year start more than a month later. As of 2026-08-30, most académies report normal access restored, but Toulouse and Nantes remain significantly impacted: at Toulouse, professional mailboxes and applications stay cut "until further notice," family access to the digital workspace is also suspended, the rector describes it as an unprecedented start of term, and "full restoration could take around two weeks", all translated from French (ZATAZ.COM, 2026-08-30), with the digital workspace targeted for relaunch on 7 September. Because substitute-teacher assignment orders are sent by email, the mailbox shutdown has left some substitute and contract teachers without their assigned school days before term starts; teacher unions warn some classes may open in September with no assigned teacher: "we risk finding ourselves on 1 September with classes lacking teachers in quite a few schools" (translated from French) (Thomas Cabioch, SNES-FSU Mayenne, via ICI/France Bleu, 2026-08-26). Toulouse has fallen back to paper timetables and phone or messaging-app communication with families (ZATAZ.COM, 2026-08-30). The ministry states payroll will still be paid on the usual schedule, and the Toulouse rector separately states all students will be accommodated in schools on the planned dates, allowing for possible last-minute adjustments, both translated from French (ZATAZ.COM, 2026-08-30).

A plausible, unconfirmed link has surfaced for the third breach this entry has so far declined to attribute. ZATAZ reported on 2026-08-07 (five days before DGCCRF's public warning) that an actor using the handle Cybernox, jointly with a second handle presented as "don't call me," claimed to have leaked a database tied to Bloctel, France's telemarketing opt-out registry, containing exactly 3,032,386 phone numbers (ZATAZ.COM, 2026-08-07). That figure and timing are consistent with DGCCRF's own disclosure of a leak affecting roughly 3 million phone numbers, 600,000 of them Bloctel registrants, taken via a fraudulently accessed professional account. ZATAZ's own reporting is explicit that this does not establish attribution: "these hacks must be treated as claims published by Cybernox. A line displayed on an underground forum does not demonstrate that an organization itself suffered a full intrusion" (translated from French) (ZATAZ.COM, 2026-08-07). Neither DGCCRF nor ZATAZ names Cybernox as the actor behind the DGFiP-adjacent Bloctel incident, so this entry records the correlation without upgrading it to attribution.

France's Paris public prosecutor's office confirms two arrests in the ZeroBytes cluster this entry tracks. The first suspect, an 18-year-old resident of the Paris region, was arrested on 2026-08-18, is suspected of participating in the cyberattacks against the tax administration and of belonging to ZeroBytes, and was placed under judicial examination and pretrial detention two days later (ZATAZ.COM, 2026-09-04). ZATAZ identifies him under the handle "ChatNoir," a presumed co-founder of the earlier Epsilon hacking collective, whose name already appears in prior proceedings tied to intrusions at Free, LDLC and the hijacked broadcast accounts of BFM-TV and RMC (ZATAZ.COM, 2026-09-05). Epsilon's own 2023-2024 breaches separately include a database of more than four million Sport 2000 customer records, and the collective has been associated with WaveStealer, an infostealer sold cheaply on Telegram and Discord that harvests locally-stored credentials and session cookies (ZATAZ.COM, 2026-09-05). A second suspect, a minor under 16, was arrested on 2026-08-26; after his police custody, he was released, with his computer equipment seized for forensic analysis (ZATAZ.COM, 2026-09-04). ZATAZ names him under the handle "Casquette," aged 15, and describes him as a known associate of ChatNoir (ZATAZ.COM, 2026-09-05). The first suspect is charged with unauthorized access to and persistence in an automated data-processing system containing personal data, an offence aggravated by acting as part of an organized group, alongside data modification, extraction, transmission and reproduction offences and a possible conspiracy charge, together carrying up to ten years' imprisonment; the investigation into a criminal association is ongoing (ZATAZ.COM, 2026-09-04). The second suspect was released without indictment at this stage, pending the forensic analysis of his seized devices (ZATAZ.COM, 2026-09-05).

The prosecutor's office's own victim list extends materially beyond the DGFiP/Éducation nationale/Bloctel thread already tracked here, and beyond ZeroBytes' separately claimed Zéro Logement Vacant compromise this store also tracks: France Travail, the French Handball Federation, Intermarché, SFR, Bureau Vallée and Pulsy are named among the organizations the cluster claimed on dark-web forums (ZATAZ.COM, 2026-09-04). ZATAZ's own alias-mapping (built on account histories, observed relationships between users, pseudonym changes and overlapping activity periods rather than resemblance alone) traces the first suspect to a cluster of aliases including Saturne, near, Nears, ChatNoir7331 and blackcat, and the second to a separate cluster converging on xMetah, xReyna and F7001 (ZATAZ.COM, 2026-09-05); the same source separately treats xMetah as a distinct, uninvolved third individual (see below), so this alias cluster's membership is itself unsettled. The timing corroborates the arrests: a message on the cluster's own forum records that "ChatNoir" stopped communicating around 18–19 August, matching his arrest window, and several ZeroBytes-adjacent forum accounts were subsequently banned or closed (ZATAZ.COM, 2026-09-05). Neither correlation by itself proves which individual controlled which account.

The arrests have not ended the campaign. The alias xMetah was not arrested, and ZATAZ assesses him as very likely responsible for a further data-leak post made on 2026-09-01, after both arrests (ZATAZ.COM, 2026-09-05). That single fact is the operational takeaway: a loosely affiliated, multi-alias extortion cluster can lose two members to arrest, including one identified as a co-founder of its predecessor collective, and continue publishing new leaks days later under a surviving alias. Law-enforcement disruption of one identity is not disruption of the cluster.

France's ANSSI delivered its incident report on the DGFiP intrusions to the Prime Minister on 2026-09-24 and published it on 2026-09-29. It reconstructs two exfiltration waves between May and August 2026, one against the impots.gouv.fr platform and one against land-registry data, and names three failures (ANSSI, 2026-09-29).

Identity. The attackers stole and used legitimate DGFiP staff credentials; ANSSI ties the theft to those credentials having been used on personal equipment, combined with the absence of strong authentication on the portals that reach sensitive resources (ANSSI, 2026-09-29). The Hacker News, reading the full report, adds that the passwords were probably taken by infostealer malware from computers DGFiP did not manage, that two portals asked for a password only, and that the accounts held no special privileges yet could reach a large amount of data (The Hacker News, 2026-09-29).

Architecture. Sensitive applications were exposed on the Internet, or reachable from the inter-ministry network without segmentation, which allowed lateral movement from a third-party body's resources, in this case the Education ministry (ANSSI, 2026-09-29).

Detection. Neither wave was detected by DGFiP's or ANSSI's monitoring: DGFiP's teams did not supervise one of the portals used to exfiltrate and nothing correlated the suspicious signals, and ANSSI's sensors sit only at the inter-ministry network's entry and exit points and the Internet, without access to application logs (ANSSI, 2026-09-29). The Hacker News reports that the data was pulled from the E-Contact tool through the second portal using automated scraping tools that copy data page by page (The Hacker News, 2026-09-29), that a June password reset addressed the alert on the first portal but did not end the attacker's open session on the second, so data kept flowing for almost 16 more hours, and that no alert fired on data volume or per-user request counts, including the 11 GB moved in three days (The Hacker News, 2026-09-29). It adds that the land-registry route went through a partner portal whose emailed one-time code was bypassed after a land surveyor's computer at a private firm was possibly compromised (The Hacker News, 2026-09-29). It also reports that ANSSI's report calls the attack unsophisticated, which contrasts with the ministry's August statement that the theft escaped detection because of the attack's sophistication (The Hacker News, 2026-09-29).

Recommendations. As summarised by The Hacker News, ANSSI recommends revoking every active session on all applications whenever a password is reset, reviewing a compromised account's activity from the likely date of compromise, using multifactor authentication whose second factor survives password theft (an emailed code is not enough if the same password opens the mailbox), monitoring every business application in a SIEM with quotas on records, requests and data volume, and refusing personal devices for work resources (The Hacker News, 2026-09-29). ANSSI's own page says an action plan addressing the exploited failures has been agreed with DGFiP (ANSSI, 2026-09-29).

Triage: night-time logins, VPN or foreign-address connections and large volumes each cause false alarms alone; The Hacker News reports ANSSI's view that combined with a per-user request count they could have raised an alert (The Hacker News, 2026-09-29).