Hacker claims to sell 4.8 million accounts from school app Nomad Education, including a 6-year-old's

The youngest is 6 years old. In the sample of 1,001 accounts published by the seller, the Cyberattaque.org observatory counted 323 minors among the 869 profiles that list a date of birth. Sixteen of them are under 13.

On the evening of October 16, 2026, a hacker calling themself Angel_Batista put up for sale on a cybercriminal forum a database they attribute to Nomad Education. This Paris-based publisher makes a study app used from elementary school through higher education. The hacker claims 4,852,437 accounts. Nomad Education has not confirmed the incident at this stage, and no one has been able to verify the total volume.

What does the sample contain?

According to the listing, each record includes the email address, name, login ID and, for some accounts, the date of birth. Cyberattaque.org and Fuites Infos examined the sample. It contains more than the hacker advertises: internal IDs, Google or Apple sign-in data (627 rows out of 1,001), family account settings and login tokens.

On those tokens, Cyberattaque.org is cautious. 138 profiles carry one with an expiration date after October 17, but the observatory cannot say whether they still work: the server may have revoked them. According to Fuites Infos, the most recent sign-in data dates from early October, which suggests a recent extraction.

There is also what the sample does not contain. No postal address, no phone number, no banking data. And no password, neither in plain text nor encrypted, in the rows examined.

4.8 million accounts does not mean 4.8 million students

The figure should be read with caution. An account is not a person: a family can have several, and the sample contains technical accounts linked to family accounts. The seller themself acknowledges that about 500,000 addresses are fake or masked by Apple's relay service. Finally, FrenchBreaches points out that putting data attributed to a company up for sale does not, on its own, prove an intrusion into its systems. How the data was obtained remains unknown.

The real risk: booby-trapped messages in the app's name

With a name, an email address, a date of birth and the certainty that the child uses Nomad, a scammer can write a convincing message: subscription to renew, account locked, tips ahead of the brevet or the bac (France's middle school and high school exams). Teenagers are less likely to spot this kind of trap. People affected by the confirmed breach at École 42 have already been warned about this type of risk.

Best practices for parents

• Do not click any link received by email or text message about the Nomad account: open the official app or website directly.
• As a precaution, change the account password, and the password of any service where it may be reused.
• If your child signs in with Google or Apple, check in that account's settings which apps have access to it, and enable two-factor authentication.
• Talk to your children: no legitimate service will ask them for a password or a payment by message.

Nomad Education will have to say whether its systems were affected. If so, the GDPR requires it to report the incident to the CNIL (the French data protection authority) if the breach poses a risk to individuals, and to notify families if that risk is high. Until then, the only certainty is that the database is for sale.