The National Agency for Adult Training suffered a cyberattack orchestrated by two hackers, resulting in the compromise of the personal data of nearly 1,7 million people. No bank details appear to be affected, but the risk of phishing is real.
This is the latest episode in the spate of attacks plaguing French public institutions. The National Agency for Adult Vocational Training (Afpa), specializing in continuing professional development, was the target of a cyberattack claimed by two hackers. The agency launched an investigation as soon as they announced they had stolen its data.
The investigation quickly identified the vulnerability: it was not located in Afpa's own information system, but in a third-party tool used to manage its hosting services. "A potential data breach appears to be linked to a vulnerability in the tool we use to manage our hosting services," explained Pierre Prady, deputy director of the agency. Since this tool is administered by an external provider, Afpa indicates that there has "apparently been no impact on the organization's own services and information systems."
The exact extent of the leak remains unclear, but initial estimates suggest that 1,7 million people may have been affected. The stolen information includes names, postal addresses, and, in some cases, telephone numbers. The most sensitive data, such as bank details and social security numbers , do not appear to have been compromised.
This limited scope should not reassure those concerned. Identity and contact information is all cybercriminals need to create convincing fraudulent messages: by impersonating Afpa or an administrative service, they can try to extract more sensitive data or money directly. Once resold on clandestine forums, this data fuels targeted phishing campaigns via email, SMS, or telephone. Afpa therefore urges the utmost caution when responding to any solicitation claiming to be from the agency.
This hacking incident comes amid a worrying trend for cybersecurity in France . Tax authorities, several telecommunications operators, and mutual insurance companies have already been affected in recent months. The government's cybersecurity platform, Cybermalveillance, estimates that nearly half of the French population has been a victim of hacking in the past year. Afpa (the French National Agency for Adult Vocational Training) indicates that it is continuing its investigations to determine the precise extent of the data involved and to notify those affected.
