In November 2023, the Universal National Service (SNU) website suffered a cyberattack that led to the theft of personal data. The French government’s response to Parliament in March 2024 confirms that an application vulnerability was exploited, then fixed, and that affected people were notified. The official and independent sources cited here document this 2023 incident; they do not substantiate a separate breach affecting 275,000 accounts.
What happened to the SNU website
A written question to the French National Assembly says the ministry was notified on November 24, 2023, and that volunteers began receiving notifications on December 6. In its response, published on March 19, 2024, the government confirmed that the SNU website was attacked through an application vulnerability. The flaw was fixed after the data theft was discovered; a complaint was filed and the incident was reported to France’s data protection authority, the CNIL.
How many people and what data
The reported scope was about 150,000 people: 62,500 current or former volunteers and 87,000 parents. For young people, the data listed were names, date of birth, email address and postal address. For parents, it included names, email address and postal address. The official response says the stolen data did not include login credentials or passwords that would grant access to the platforms.
Why the information still matters
A postal address, date of birth and connection to the SNU can make a fraudulent message more convincing, even without a password. An email referring to a placement, registration or administrative process may persuade someone to open an attachment, send a document or share a code. Targeted phishing is a risk to watch for, not proof that a particular campaign used the stolen data.
Practical steps for people affected
Verify a summons or request by opening the official SNU website yourself or contacting the organization through a number you already know. Do not share login codes or send documents in response to an unexpected link. If you reused a password on another service, replace it there with a unique one and enable multifactor authentication when available.
For signs of credential-stealing malware and ways to protect business access, see our guide to infostealers.
What the official response confirms
The ministry said that affected people and their legal representatives had been notified. The response also says the data was hosted in France and describes measures taken after the incident, including a new security audit of the platforms. These details describe the institutional response reported in March 2024; they do not establish that there was no later risk or that a new breach occurred.
Teams managing shared accounts can formalize how credentials are created, stored and reviewed in an SMB password policy.
How Soclyde fits
Soclyde does not protect the SNU website or undo the exposure of personal data. Its local-first vault can help users keep unique passwords on their devices, reducing the chance that a stolen password is reused across multiple services.
Takeaway
The SNU breach documented by the French National Assembly dates to 2023 and affected about 150,000 young people and parents; the official response says passwords were not included. Watch for personalized messages and verify requests through an official channel. To reduce password reuse, see our secure password generator guide.
