PARIS, 24 AUG 2026 — A criminal actor using the name ZeroBytes is offering data said to be taken from France's national education ministry, and the figure being repeated across the coverage is 346,178,591. That number is a count of raw lines across roughly 43GB in about 2,500 files. It is not a count of people.
The same actor published deduplicated figures alongside it: approximately 4.35 million staff identifiers and 1.22 million unique students. Those are the numbers that describe individuals, and they are two orders of magnitude smaller than the headline.
What a line count actually counts
The gap between 346 million and 5.6 million does not mean anyone is lying. It is what happens when a database export is measured by its rows.
Administrative education systems record events, not just identities. Enrolments, class assignments, attendance entries, grade records, transfers between schools, annual roll-forwards: one pupil moving through a school career generates hundreds of rows across a decade, and an export that spans multiple systems and years multiplies that again.
A line count is a measure of file size, useful to an administrator estimating processing time and useless as a victim count. When it appears in a headline as though it were one, as it did here, the exaggeration factor is roughly sixty.
To the actor's credit, he supplied the deduplicated figures himself. The inflation was introduced downstream, in the retelling.
Why 4.35 million staff is not 4.35 million teachers
The staff figure needs its own correction, and again the actor is clearer about it than the coverage.
France employs on the order of a million people across its education system. A file containing 4.35 million distinct staff identifiers therefore cannot be a roster of current employees, and the actor states plainly that it spans decades of historical personnel records rather than serving staff.
That distinction cuts two ways. The number of currently employed people exposed is far smaller than reported. But the exposure also reaches former staff from decades ago — people with no remaining relationship with the ministry, who will not be watching for a notification and who will be the hardest to reach.
A breach of historical records is not a lesser one, only a differently distributed one. The people least likely to hear about it are the ones least able to act.
Two descriptions of one intrusion
The most substantive open question is whether the ministry and the actor are describing the same event.
The ministry acknowledged on 31 July that it had suffered a fraudulent intrusion on the night of 25 July, said it followed the takeover of a professional account, and scoped it to an information system used for staff training. In a further statement it said all staff potentially affected had been individually informed, and committed to notifying the legal representatives of affected students once the investigation concludes.
The actor's description is considerably wider. It names systems covering primary and secondary school administration and a federated academic directory, staff exports spanning 33 academies, and two directory dumps containing network accounts with hashed passwords.
A staff training platform and a set of national school administration systems are not the same scope. Either the ministry's account is the accurate one and the actor is inflating what he holds, or a training system provided the initial foothold and the intrusion reached further than the first scoping described. The second pattern is common enough that it should not be dismissed, and it is exactly what the phrase “takeover of a professional account” would enable.
Neither reading is confirmed. Both remain plausible, and the ministry's own commitment to notify students implies it expects their data to be involved.
Detected, and left in place
The actor makes one further claim that deserves attention precisely because it is unflattering in a specific, technical way rather than a boastful one: that he was detected without his access being cut off, and remained in place for days.
Nobody has confirmed this and an attacker has every incentive to describe defenders as incompetent. It is worth weighing anyway, because detection without containment is the most common failure in incidents of this shape. An alert fires, it enters a queue, and the work of deciding whether it is real takes longer than the work of finishing the exfiltration.
If the claim is accurate, the lesson is not that detection failed. It is that detection succeeded and changed nothing, which is a harder problem to fix and a more expensive one to admit.
What a hashed password dump is worth
Directory dumps containing hashed credentials are routinely reported as though hashing settled the question. It depends entirely on the algorithm.
A modern password hash with a per-user salt and a deliberately high work factor makes bulk recovery impractical. A legacy scheme in a directory that has accumulated accounts over many years does not, and long-lived institutional directories are exactly where weak historical schemes survive.
The algorithm has not been disclosed, so the honest position is that the value of those dumps is unknown. What is known is that any account holder who reused a password elsewhere should treat it as exposed regardless of the hash, because that risk does not depend on the ministry's cryptography.
What remains unconfirmed
Almost all of the scale is unverified. The ministry has not confirmed the record counts, the systems the actor names, or the LDAP dumps. The sample offered for sale has not been independently validated in public reporting. Claims made by a seller advertising stolen data are marketing as well as description.
There is also a discrepancy in the dates: the ministry places the intrusion on the night of 25 July, while at least one account of the actor's posting dates the access earlier in the month. That may reflect the difference between first access and the night it was noticed.
This is the third significant French public-sector data incident to surface in short order, alongside breaches involving the tax administration and cadastral records, with the same actor name attached. Whether that reflects one campaign or one person collecting credit is not established.
What it means from here
The pattern here should be familiar to anyone who followed the Alcon extortion claim, where an advertised figure of 25 million records was set against roughly 218,000 actually published. The advertised number is marketing. The verified number is evidence.
For any institution running a national student information platform, a federated academic directory or a ministry staff portal, this incident raises two questions that have nothing to do with France.
First, how many years of former staff and former students does the production database still hold, and why. Retention is the variable that turns a contained incident into a multi-decade one, and it is set by policy rather than by attackers. Second, if an alert fired tonight on a single compromised staff account, how long would it take to cut that access off, as distinct from noticing it. The French incident's most useful detail, if it holds up, is that those two intervals were not the same.
View author profile → · Editorial policy
