CSIDB logo
Incident

Académie de Toulouse

Incident posture

Attack window
Jul 2026
Location
France
Status
Ongoing
CIA posture
Available to members
Updated
2026-09-03 00:32

Linked entities

Victim
Académie de Toulouse
Threat actors
0 actors
Sources
1 source

Timeline

Occurred
Undetermined
Discovered
Jul 2026
Disclosed
Jul 2026
Resolved
Pending

Summary

Following a cyberattack that disrupted education systems, the Toulouse education authority reported that email and professional applications remained inaccessible, forcing schools to use paper timetables and registers for the start of the term. Digital learning platforms were expected to be restored soon, while most academies across the country had already resumed normal online services. In the Nantes area, only partial email access was available, leading teachers to rely on paper lists for attendance. Officials emphasized that the breach had exposed personal data of thousands of teachers and pupils, prompting a precautionary suspension of affected services.

Motives

Detailed motive labels are available to members.

0 motives

TTPs

Detailed technique labels are available to members.

0 techniques

Description

The cyberattack on France’s education systems was first detected in late July, with the Ministry of Education announcing on 31 July that the breach had been identified six days earlier. In mid‑August, hackers claimed to have obtained the personal data of tens of thousands of teachers and pupils across the country. As a precaution, access to a number of digital tools was suspended, prompting the ministry to report that services had returned to normal in 28 of France’s 30 education academies. Toulouse and Nantes remained the two academies still experiencing disruption.

In Toulouse, the ministry stated that access to email and professional applications would remain suspended until further notice, while Karim Benmiloud, the official in charge of the Toulouse education authority, indicated that full restoration of digital services was expected within around two weeks. Digital learning platforms, known locally as ENT systems, were scheduled to be reactivated on 7 September, and the ministry confirmed that the preparation of class timetables had not been affected, although pupils in Toulouse would receive their schedules on paper. Schools in the Nantes area faced similar constraints, with only partial email access available depending on the devices and settings being used, leading teachers to take attendance with paper lists for the start of the new term.

The ministry emphasized that, aside from the ongoing issues in Toulouse and Nantes, digital services had been restored for the majority of academies, allowing most schools to resume normal online operations for the rentrée. Officials continued to monitor the situation and coordinate with local authorities to ensure that essential functions such as timetable creation and communication could proceed despite the reliance on paper‑based processes. The incident highlighted the vulnerability of centralized education IT systems and prompted a temporary shift to analog methods while restoration efforts proceeded.

Sources

Sources available to members: 1 source.

CSIDB