Service national universel (SNU)
ModerateConfirmedPublic sector
The admin.snu.gouv.fr portal, used by partner organisations of France's national civic service programme (SNU) to manage assignments and applications, was claimed to have been breached in early September 2026 by an attacker using the alias LunarisSec, who says an IDOR flaw was exploited. Samples reviewed by several specialised outlets cover roughly 275,000 accounts: about 270,000 with name, email and phone number, and nearly 5,000 accounts belonging to partner-organisation managers (local authorities, fire departments, associations) that also include role, region, organisation and activity history. The SNU had not issued a public statement on the incident at the time of writing.
The exposed contact details, linked to an identifiable professional affiliation (municipality, fire department, association), expose the individuals concerned to targeted phishing attempts impersonating an SNU partner organisation.
- Disclosed on
- September 7, 2026
- Accounts affected
- 275,000
- Sector
- Public sector
- Country
- France
- Cause
- Misconfigured database
Exposed data
- Full name
- Email address
- Phone number
- Employment data
- Customer ID
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact