---
title: "Data breach at Service national universel (SNU)"
description: "The admin.snu.gouv.fr portal, used by partner organisations of France's national civic service programme (SNU) to manage assignments and applications, was claimed to have been breached in early September 2026 by an attacker using the alias LunarisSec, who says an IDOR flaw was exploited. Samples rev"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-07-service-national-universel-snu
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-07
dateModified: 2026-09-07
---
# Service national universel (SNU)

Data breach — Moderate

The admin.snu.gouv.fr portal, used by partner organisations of France's national civic service programme (SNU) to manage assignments and applications, was claimed to have been breached in early September 2026 by an attacker using the alias LunarisSec, who says an IDOR flaw was exploited. Samples reviewed by several specialised outlets cover roughly 275,000 accounts: about 270,000 with name, email and phone number, and nearly 5,000 accounts belonging to partner-organisation managers (local authorities, fire departments, associations) that also include role, region, organisation and activity history. The SNU had not issued a public statement on the incident at the time of writing.

The exposed contact details, linked to an identifiable professional affiliation (municipality, fire department, association), expose the individuals concerned to targeted phishing attempts impersonating an SNU partner organisation.

| Fact | Value |
| --- | --- |
| Disclosed on | September 7, 2026 |
| Accounts affected | 275,000 |
| Sector | Public sector |
| Country | France |
| Cause | Misconfigured database |
| Severity | Moderate |
| Status | Confirmed |

## Exposed data

- Full name
- Email address
- Phone number
- Employment data
- Customer ID

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Service national universel (SNU)](https://frenchbreaches.com/alertes/service-national-universel-snu-mtrfy9tvk9n0jcgh2yk) — FrenchBreaches
- [Cyberattaque : le site du Service national universel visé, 275 000 comptes compromis](https://actu.orange.fr/france/cyberattaque-le-site-du-service-national-universel-vise-275-000-comptes-compromis-magic-CNT000002rMFe4.html) — Orange Actu
- [Cyberattaque contre le SNU, plus de 275 000 comptes revendiqués](https://www.cyberattaque.org/cyberattaque-contre-le-snu-plus-de-275-000-comptes-revendiques/) — Cyberattaque.org
- [French SNU Portal Breached, Over 270,000 User Records Exposed](https://www.brinztech.com/breach-alerts/brinztech-alert-french-snu-portal-breached-over-270000-user-records-exposed) — BrinzTech

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-07-service-national-universel-snu
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees