The ministry confirmed that an internal account used to manage Parcoursup in Occitanie was impersonated and used to extract data relating to around 705,000 candidates from the 2023 and 2025 sessions. This was access to a staff-only module, not confirmation that candidates’ personal accounts were taken over. The main practical concern for affected people is phishing that exploits their education history.
What happened
After a report in March 2026, the Ministry of Higher Education identified the impersonation of an account used by staff to manage Parcoursup data in the Occitanie academic region. The fraudulent access relied on legitimate credentials and was used in October 2025 to extract data.
The extraction concerns applications from completed 2023 and 2025 sessions. The ministry estimates that around 705,000 candidates living in Occitanie or having applied there are involved. This figure describes the data scope, not the number of candidate accounts taken over.
Which data is involved?
The listed information includes identity details, nationality, date of birth, address, email and phone number. It may also include education, scholarship status, training path and, for minors, the relationship and socioeconomic category of legal guardians.
The ministry says the data is no longer accessible and that the affected module was anonymised, its credentials revised and its access controls strengthened. The CNIL was notified and a complaint was filed. These measures do not erase the risk from information already extracted.
Why the phishing can be convincing
A fraudster who knows a requested course, application period or student status can write a much more credible message than generic spam. They may claim that a preference must be confirmed, a document is missing or an offer is about to expire.
The extraction does not mean that a candidate’s personal account or password was compromised: the ministry describes the impersonation of a staff-only internal account. Check requests in the official application area, protect the linked email account with multi-factor authentication and do not reuse passwords across services.
Another incident shows how personal data can make a fraudulent message more convincing: read our article on the Basic-Fit data breach and phishing risk.
What candidates and families should do
Reach Parcoursup by typing the site address yourself. Check every request in the official application area and contact the institution through its public contact details if in doubt. No urgent message should push you to share a code, identity document or banking details.
Monitor the email address and phone linked to the application. Enable MFA on email when possible and use a different password for every service. Keep suspicious messages as evidence for reporting.
For institutions and administrations
Internal accounts should be named, protected with MFA and limited to the data required for the role. Administrative modules need separate controls, regular permission reviews and monitoring for unusual exports.
Notification messages should clearly state the data involved, the relevant period, the official contact channel and that no secret will be requested. This leaves less room for fake support to exploit the incident.
The Soclyde connection
Soclyde does not protect Parcoursup and does not replace the ministry’s measures. It helps create unique secrets, keep them in an encrypted vault and organise rotation for email and administrative services.
Takeaway
Parcoursup illustrates how legitimate credentials used against an internal account can expose a large amount of academic context. The response is to verify official communications, protect email and treat every urgent request as a possible impersonation attempt.
For more guidance, read our secure password generator guide or contact Soclyde.
For handling shared access with clear sharing and revocation rules, see our guide to secure team password sharing.
