ICT in Education Toolkit Breach: 39,044 French EdTech Users’ Data Exposed

HEROIC's DarkHive intelligence system discovered the ICT in Education Toolkit data breach, exposing 39,044 records. The breach occured at an unknown point in time, affecting users of this France-based educational technology platform serving teachers, students, and educational professionals. Leaked data includes email addresses and a mix of plaintext passwords, MD5-hashed passwords, and other hash formats, meaning the severity of exposure varies by account but includes many immediately usable plaintext credentials.

Why This Is Dangerous

The ICT in Education Toolkit breach is particulary serious because it exposes passwords stored in three different formats. Accounts with plaintext passwords are immediately exploitable with zero processing required. Accounts with MD5-hashed passwords can be cracked within hours using GPU-accelerated rainbow table attacks. The remaining accounts using other hash formats may take longer but are still vulnerable to brute force and wordlist attacks. Teachers and educational technology professionals affected by this breach likely use the same credentials on school management systems, government education portals, and professional email accounts. Credential stuffing attacks using recovered credentials can compromise sensitive student records and institutional systems.

What Was Exposed

• Email Address
• Password (Plaintext for some accounts)
• Password (MD5 Hash for some accounts)
• Password (Other hash format for some accounts)

Why This Matters

Education sector breaches carry heightened risk because teachers and administrators have access to student personal data, grade records, and institutional networks. French educational professionals who registered on this toolkit platform may have reused thier password on national education portals such as France's academic networks or regional school management systems. Even accounts stored with stronger hash formats are at risk if the underlying password was weak, which is common among users who recieve no security training. This mixed-hash breach demonstrates how inconsistent security practices across a user database compound the overall risk to all affected users.

How Mixed-Hash Database Breaches Work

A mixed-hash database breach occurs when a platform has stored passwords using inconsistent methods, often because security practices changed over time as the platform evolved. Some users registered when plaintext storage was used, others when MD5 was the standard, and later accounts may use stronger algorithms. When attackers steal such a database, they immediately exploit the plaintext accounts, then systematically crack the weaker hash formats. The recovered credentials are packaged into combolists and distributed for credential stuffing campaigns against educational institutions, government portals, and professional services.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like ICT in Education Toolkit. Visit heroic.com to scan your email address and find out if your information was exposed.