École 42 confirms data breach that may affect up to 140,000 people

On October 9, 2026, a person using the alias “fentag” put a file up for sale on a cybercriminal forum, presented as the École 42 directory. They claim 140,080 profiles and 94,427 photos, collected the day before. According to Fuites Infos, the school acknowledged the incident and estimates that up to 140,000 people may be affected, across several campuses in its network.

Extraction through a legitimate account

According to the first findings of the school's investigation, reported by Fuites Infos, the data was not obtained by breaking into its servers. It was scraped automatically from the intranet, using a user account that had legitimate access to it. This is known as scraping, and the platform's terms of use prohibit it. FrenchBreaches adds that this student account was reportedly compromised first, then blocked the next day, after the data had already been copied. The school has not confirmed this point.

What data is involved?

According to the school, cited by Fuites Infos, the file contains:

• last names, first names, student email addresses and login names;
• academic information: level, program, grades, “coalition” (the internal team) and “wallet”;
• links to profile photos.

The “wallet” is a virtual currency specific to the platform: it is not banking data. The school states that no passwords are included in the data set. Clubic and FrenchBreaches did not find any either. Fuites Infos analyzed a sample of 1,000 profiles: it mixes candidates for the “piscine” (the selection period), students, staff members and test accounts.

The figures put forward by the seller cannot be verified. A record is not necessarily a distinct person. Students at 42 Next are reportedly not affected.

Measures taken by the school

Again according to Fuites Infos, École 42 notified its students and piscine candidates by email. It filed a complaint and began notifying the CNIL (Commission nationale de l'informatique et des libertés, the French data protection authority). It also disabled the links to profile photos. The school says it has not seen, at this stage, any publication of the data or any malicious use.

Best practices for those affected

• Be wary of emails claiming to come from your campus, the IT department or a recruiter that mention your level or program. These details make phishing more convincing.
• Never share your intranet login details, even with someone who seems to know your background.
• Enable two-factor authentication wherever it is offered.
• Do not reuse your 42 password on other services.