Hackers say they have stolen sensitive employee information from Sorbonne Université.
Sorbonne University Staff Data Leaked in Claimed Major Breach
A threat actor on the dark web is disseminating sensitive data allegedly stolen from Sorbonne Université, a prestigious French university located in Paris. The university has 3,000 staff members, 22,000 students, and 2,500 doctoral students.
“The threat actor attached one sample file, which had 32,000 employee entries, including full names, departments they work at, job positions, emails, employment contract types, salaries, possible zip codes, and employee codes used in the internal systems,” Cybernews researchers, who reviewed the leaked data, said.
“Other data threat actor claims are not present in the sample.”
However, Cybernews is unable to verify the claims, as the hackers only offer full access to the data and verified bank account numbers through an encrypted live session.
“The most likely potential impact is data abuse for social engineering attacks,” our researchers warn.
“If it is true that the threat actor has banking and social security information of the employees, there is also a risk for financial fraud and identity theft.”
What are the hackers’ claims?
The attackers’ account on the illicit forum is new, created about a month ago.
“A data breach has been identified, and the exfiltrated files contained several types of sensitive information,” the hackers said in French on the illicit forum.
The attackers detail seven categories of data that interested parties can obtain from them. These include the following:
- Professional identity: full names, email addresses, internal identifiers, service/department, position, and employment status (permanent, fixed-term, temporary, contract worker, etc.).
- Contractual data: start/end dates, contract type, renewals, and administrative documents ( PDFs and amendments).
- Compensation records: salary, bonuses/allowances, grades, digitized payslips, remuneration history.
- Banking details: bank account numbers (RIB/IBAN, BIC) and other salary transfers data.
- Social security information: social security numbers, mutual/insurance certificates, and sick leave documentation.
- Supporting documents: CVs, cover letters, diplomas, and various employment documents.
- Other HR exports: data tables listing employees, internal directories, contract listings, assignment tables, and more.
