43 gigabytes, almost 2,500 files and 346 million lines. Cybercriminal ZeroBytes claims to have exfiltrated a massive amount of data belonging to National Education. The claimed files cover more than twenty years of history and concern students, parents, teachers and administrative staff. These figures must, however, be considered with caution, but the ministry has confirmed an intrusion that occurred on the night of July 25 after the theft of a professional account. On the other hand, he did not validate the extent of the leak claimed by ZeroBytes. We take stock of this new leak which is causing problems a few days before the start of the school year.
Students, teachers and parents in claimed files
According to the hacker, the extraction was carried out using VPN access allowing access to several internal environments. The data would represent exactly 346,178,591 raw, undeduplicated rows, spread across approximately 2,500 files.
Part of it would come from the 1st Degree Student Base, used for the administrative management of children in nursery and primary school. The files could contain identities, dates of birth, addresses, establishments attended, school careers and information on catering, transport or daycare. Links with parents and legal guardians would also be present.
Other extractions would come from SCONET, dedicated to secondary school students, and from systems ensuring individual monitoring of absences, summonses or dropout situations.
Nearly 17.8 GB would also concern I-Prof, the staff career management tool. ZeroBytes uses data from the 33 academies and approximately 4.35 million unique identifiers after partial deduplication. This figure would, however, include current agents, former staff, retirees and histories accumulated since the early 2000s.
Finally, directories linked to the academies of Créteil and Versailles bring together more than 602,000 account entries. Some would contain cryptographic password hashes. These are not plaintext passwords, but these fingerprints can sometimes be exploited when credentials are weak or reused.
A perimeter still contested by the ministry (but can we still believe it?)
The 346 million lines do not correspond to that many victims. The same person can appear in several databases and in many successive records. No reliable estimate of the total number of individuals affected is therefore available.
Above all, the claim goes well beyond the scope currently recognized by National Education. In its press release dated July 31, the ministry indicates that the intrusion targeted a system dedicated to staff training. The data likely to have been stolen concerns agents who have worked in the academy since 2001: identity, status, functions and, for some, address, telephone and social security number.
The ministry specifies that this system does not contain any student data, passwords or banking information. If the files described by ZeroBytes are authentic and indeed come from this attack, this would mean that the hacker reached systems other than the one initially identified.
