Data Leak at the National Education System? A Criminal Gang Claims Responsibility for a Cyberattack

Stormous, a cybercriminal gang specializing in extortion, has claimed responsibility for a major cyberattack in France. As researcher Clément Domingo explains, the group claims to have stolen data related to the Ministry of National Education, Higher Education, and Research. The announcement is visible on the gang's website on the dark web.

At the end of their operation, the hackers allegedly stole "40,000 critical data items" belonging to students. The information reportedly includes the login URL, email, user ID, plaintext password, country of residence, and login date. This information is formidable in the hands of a hacker, especially criminals who orchestrate phishing attacks.

Data-stealing malware behind the attack

For now, the gang is content with a 1,400-line data sample, and announced an update for Thursday. In two days, the group will release all the information in their possession. The gang is likely demanding a ransom for the stolen data.

However, researcher Clément Domingo has analyzed the sample posted online by Stormous. According to the expert, it seems clear that the data was collected by infostealer malware. These viruses, specialized in data exfiltration, would have infiltrated students' devices in order to seize their information.

Also read: Hacked data of millions of French people resurfaces on the dark web

An extraction operation against the French government

It was already by using infostealers that Stormous compromised the data of several French government sites. At the end of May, the gang disseminated "2,000 pieces of information from French government officials", the researcher reports. Here again, logins, passwords, and email addresses were stolen. The gang revealed that they carried out a "data extraction operation targeting French government infrastructure."

It is not yet possible to confirm or deny the gang's claims. Contacted by 01net, the Ministry of National Education has not yet responded to our requests for information. We will provide more information as soon as possible.