Cours Thalès
ModerateReportedEducation
On 3 October 2026, a user on a cybercriminal forum claimed to have obtained about 40,000 billing records from Cours Thalès, a French school and higher-education preparation provider. The published samples link the name of the paying client and of the enrolled person to a postal address, a client reference, an invoice number and date, and the payment amount, method, date and status. The author says an IDOR vulnerability was exploited; this is unconfirmed. The 40,000 figure counts records, not distinct people: one person can appear on several invoices, and the files cover both payers, often parents, and enrolled persons. Cours Thalès has not issued a statement so far.
These data allow a malicious third party to link an enrolled person to their payer and postal address, and to use real billing details to make fraudulent letters or messages credible.
- Disclosed on
- October 3, 2026
- Incident dated
- October 3, 2026
- Sector
- Education
- Country
- France
- Cause
- Undisclosed
Exposed data
- Full name
- Postal address
- Customer ID
- Order history
You are only affected if you had an account or an order with this organisation.
What you can do
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact