In 2026, two incidents hit alternance candidates: the hacking of Parcoursup in Occitanie (705,000 candidates exposed, discovered in March 2026 and made public on 23 April) and the claim, on 28 June 2026, of a data leak involving the Génération #HDF card in Hauts-de-France, not officially confirmed at this stage. If you are an apprentice or are looking for a contract, your personal data already circulates on several platforms — it is better to know what to do.
In short: in 2026, the personal data of around 705,000 Parcoursup candidates was stolen, and a leak targeting Génération #HDF cardholders was claimed but not confirmed. Apprentices are a tempting target because their data (scholarship status, contract, alternance) can be used for targeted scams (fake recruiters, fake aid, phishing). Three reflexes: check whether your email is in a breach on haveibeenpwned.com, enable two-factor authentication everywhere, and never send documents or bank details before the official signing of an alternance contract.
What happened in 2026?
Two incidents have marked the year, and they directly concern alternance candidates.
The Parcoursup hack (April 2026)
- Volume: approximately 705,000 candidates exposed.
- Sessions affected: Parcoursup 2023 and 2025.
- Geographic target: candidates who submitted wishes in Occitanie.
- Date of intrusion: October 2025.
- Date of discovery: March 2026 — i.e. 5 to 6 months later.
- Vector: legitimate login credentials of staff of the Occitanie academic region, stolen and misused (no technical flaw in the platform itself).
- Official notification: 23 April 2026 by the French Ministry of Higher Education and Research.
According to the French Ministry of Higher Education, the fraudulent access was carried out using stolen legitimate credentials; the CNIL was notified and a complaint was filed with the Paris public prosecutor's office. — French Ministry of Higher Education press release, 23 April 2026
The Génération #HDF leak (June 2026)
- Claim: 28 June 2026 (posted by a hacker).
- Source: Génération #HDF card, a scheme by the Hauts-de-France region for high-school and apprentice students.
- Data claimed: surname, first name, date of birth, address, phone, email, school, scholarship status, contactless card ID.
- Status: unconfirmed claim at this stage, to be confirmed with the Hauts-de-France region.
Which apprentice data is most at risk?
All the information you have submitted for your searches (Parcoursup, CFA, France Travail, regions, OPCO) can leak. The most exploited by scammers are:
| Data | Risk if leaked |
|---|---|
| Scholarship status | Targeted phishing on aid, fake promises of bonuses |
| Academic email address | Impersonation to contact schools or fake recruiters |
| Phone number | Smishing (fraudulent SMS) and callback attempts |
| Date of birth + address | Bank or administrative identity theft |
| Online CV | Diversion to fictitious alternance offers |
| ÉduConnect credentials | Access to other public services |
⚠️ A single piece of data is rarely dangerous. It is their cross-referencing that makes attacks credible: a scammer who knows your name, your school and your scholarship status can write a very convincing email.
What should you do concretely?
Step 1 — Check whether your data has leaked
Two free, trusted tools are enough for an initial diagnosis:
- haveibeenpwned.com: enter your main email address. If it appears, immediately change the passwords of the accounts that use it.
- cybermalveillance.gouv.fr: personalised diagnosis and connection with a local provider if you are a victim.
Step 2 — Enable two-factor authentication (2FA)
Two-factor authentication is today the best protection against account takeover, even if your password leaks. Enable it as a priority on:
- Your main email (Gmail, Outlook, iCloud) — it is the cornerstone of all your accounts.
- France Travail, Ameli, CAF, impots.gouv.fr and other public services.
- ÉduConnect and any portal of your CFA or university.
- Your online bank (often enabled by default).
Step 3 — Adopt the right password habits
- A unique password for every important account: email, bank, school, Apprentice space.
- At least 14 characters mixing upper case, numbers and symbols — or better, a passphrase that is easy to remember ("MyCFA-isIn-Lyon-since-2024!").
- A (free) password manager: Bitwarden or KeePass. It remembers your passwords and alerts you if one of them appears in a known leak.
- Never reuse your main email password anywhere else.
Step 4 — Recognise a targeted scam
Alternance-related scams have become more professional in 2026. The most frequent warning signs:
"A so-called recruitment agency contacts you on WhatsApp about a very attractive alternance offer, asks for your ID documents and bank details before any interview, and insists that you sign an online 'confidentiality agreement'."
The 5 signals that should alert you:
- You are contacted before any application through an unusual channel (WhatsApp, Telegram, SMS).
- You are asked for a payment, "application fees" or a security deposit.
- You are pressured to send bank details, ID card or driving licence before the interview.
- The contact email is @gmail.com, @outlook.com while the company has an official site.
- The offer is too good to be true: salary 30% above the market, full remote work, immediate hire.
To recognise them and report them, see our full article on fake recruiter scams in alternance.
Your remedies if you are a victim
If, despite these precautions, you notice fraudulent use of your data, here is the procedure to follow:
| Step | Action | Where / how |
|---|---|---|
| 1 | Keep the evidence | Emails, SMS, screenshots, disputed bank statements |
| 2 | Report the scam | Signal Spam (email), 33700 (text message), Phishing Initiative (fraudulent website) |
| 3 | File a complaint | Police station, gendarmerie, or online via the THESEE platform for an internet scam |
| 4 | Inform your bank | Dispute unauthorised transactions as soon as possible and block your card if needed |
| 5 | Contact the CNIL | Online complaint on cnil.fr if an organisation does not respect your data rights |
| 6 | Inform your CFA and France Travail | To secure your application file |
The applicable texts are article 226-4-1 of the French Penal Code (identity theft), article 313-1 (fraud) and article 323-1 (fraudulent access to a data system). The Parcoursup incident has already led to a complaint filed by the ministry with the Paris public prosecutor's office and a notification to the CNIL.
Personal data and alternance: what the law says
In France, the data used for alternance is protected by two main texts:
- GDPR (European Regulation 2016/679): right of access, rectification and erasure of your data.
- Informatique et Libertés Act (Law no. 78-17 of 6 January 1978, amended in 2018 to fit with the GDPR): its application is overseen by the CNIL.
Concretely, you can at any time ask your CFA, France Travail or an OPCO for the list of data they hold on you, and demand its deletion if it is no longer needed.
What if you are applying for an alternance right now?
Searching for an alternance mechanically exposes your data to several players. To limit the attack surface:
- Only share your CV with verified platforms — start with our search page for alternance offers.
- Use a dedicated email address for your alternance search, different from your main mailbox.
- Never send your original documents (ID card, bank details, medical certificate) before the official signing of your alternance contract.
- Always check the company's SIRET on annuaire-entreprises.data.gouv.fr before any exchange.
- See the page of companies recruiting apprentices to target reliable recruiters.
Key takeaways
- One confirmed massive breach hit alternance candidates in 2026: Parcoursup (705,000 candidates, 2023 and 2025 sessions, Occitanie); another, targeting the Génération #HDF card (June 2026), was claimed without official confirmation.
- Apprentices are a tempting target: their scholarship status, contract and card number can be exploited for targeted scams.
- Three immediate reflexes: check your emails on haveibeenpwned.com, enable two-factor authentication everywhere, and strengthen your passwords with a manager.
- Report and file a complaint: Signal Spam or 33700 for a fraudulent message, police station or gendarmerie for identity theft, THESEE for an online scam, a complaint to the CNIL if your rights are not respected.
- Never send your official documents or your bank details before the effective signing of your alternance contract.
Sources: French Ministry of Higher Education, Research and Space (press release of 23 April 2026), Clubic and Cyberattaque.org (April and June 2026), CNIL, cybermalveillance.gouv.fr.