AFPA (France's national adult vocational-training agency) confirms a data extraction potentially affecting up to 1.7 million people, linked to a flaw in a third-party-hosted accommodation-management tool
AFPA links a potential data extraction to a flaw in a vendor-hosted tool after two criminal claims a day apart
Analysis
AFPA, France's national public adult vocational-training agency, confirmed a potential extraction of identity, address and possibly phone-number data on up to 1.7 million people after the handles xMetah and Cybernox claimed 971,420 and 1,732,811 records a day apart in mid-September 2026, figures FrenchBreaches warns must not simply be summed (Cyberattaque.org, updated 2026-09-19 · Clubic, 2026-09-20 · FrenchBreaches, updated 2026-09-19). AFPA says its first investigations found the potential extraction linked to a flaw in a third-party-hosted accommodation-management tool outside its own information system, a link it words cautiously, and it has neither confirmed the insecure direct object reference Cybernox describes nor established whether both datasets come from one environment (Clubic, 2026-09-20 · Cyberattaque.org, updated 2026-09-19). It is relevant as a European public agency exposed through a vendor-hosted administrative tool.
Cited evidence
According to AFPA, the hacked application contained people's identity and address, and possibly their phone number, but "a priori" no banking data or Social Security number. (translated from French)
This tool 'is hosted by a third-party vendor and is external to our information system, so there was, a priori, no impact on AFPA's own services and information systems.' (translated from French)
AFPA now confirms that a data extraction potentially took place and states that the incident could affect up to 1.7 million people. (translated from French)
Updates1
AFPA's statement is hedged: its first investigations found a "potential" data extraction that it links to a flaw in a vendor-hosted accommodation-management tool, and it has not established whether the two claimed datasets were taken from a single environment (Clubic, 2026-09-20). The entry previously said AFPA had traced the extraction to that flaw and that both claims pointed to it.
Sources3
Revision history
- Published 2026-09-21T0410Z-intel
- Correction 2026-09-30T0639Z-audit
Priority is lowered from notable to routine: a French training-agency data extraction with no reusable vector. The body is trimmed to routine-incident length and the sourcing note is plain provenance. The title, headline, summary and body now keep AFPA's hedge, a potential extraction linked to a flaw in a vendor-hosted accommodation-management tool, instead of saying AFPA traced it there. The headline no longer says both claims point to the same flaw, the unsourced 'worker' detail is removed, and the claim dates, on which the sources differ, are narrowed to a day apart in mid-September.
Changed: priority sourcing_note body title headline summary
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.