Nantes academy

Summary

A cyberattack disrupted French education digital services over the summer, prompting the suspension of email and professional applications in several academies while authorities worked to restore normal operations. By the start of the new school year, services had returned to normal in 28 of the 30 regional academies, but the Nantes academy and the Toulouse academy continued to experience limited access, with teachers relying on paper lists for attendance and paper timetables for class schedules. The Ministry of Education reported that digital learning platforms were expected to be reactivated soon, though full restoration of email remained pending in the hardest‑hit areas.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In late July 2026, French education authorities first detected a cyberattack on the national school information system, with the Ministry of Education announcing on 31 July that the breach had been identified six days earlier. By mid‑August, the attackers claimed to have exfiltrated the personal data of tens of thousands of teachers and pupils, prompting the ministry to suspend access to a range of digital tools as a precautionary measure. While the majority of the country’s thirty education academies saw their services restored to normal within weeks, the academies of Toulouse and Nantes remained among the hardest hit, with email and professional applications still unavailable or only partially functional. In Toulouse, the local education authority announced that email and professional applications would stay suspended “until further notice,” estimating that full restoration would take around two weeks and that the digital learning platforms known as ENT (Environnement Numérique de Travail) would be reactivated on 7 September. In Nantes, the ministry reported that only partial access to email was available, depending on the devices and settings being used, and a local teacher described the situation as extremely complicated for staff attempting to communicate electronically.

As a result of these disruptions, schools in both academies were forced to revert to non‑digital methods for the start of the 2026‑2027 school year: teachers prepared paper timetables and registers, and on the first day of term they took attendance using paper lists rather than electronic systems. On Tuesday, 1 September 2026, millions of pupils returned to classrooms across France, with those in Toulouse and Nantes relying exclusively on paper‑based processes for administrative tasks. The ministry emphasized that the actual preparation of class timetables had not been compromised, but that pupils in Toulouse would receive their schedules on paper, and similar arrangements were anticipated for Nantes. Despite the limited functionality of email, some digital services were gradually being brought back online, with the ministry noting that services had returned to normal in twenty‑eight of the thirty academies by the end of August. The incident unfolded against the backdrop of the final school year of President Emmanuel Macron’s second term, a period that teacher unions have publicly criticized, though the narrative of the attack itself remains confined to the technical disruption, its immediate effects on school operations, and the steps taken to contain and remediate the breach.

Sources

Sources available to members: 1 source.