Académie de Montpellier / CSJM targeted by Medusalocker ransomware group

• Ransomware group: Medusalocker
• Country: France
• Sector: Education
• Announcement date: May 5, 2026

The Medusalocker ransomware group has posted an announcement on its leak site claiming to have leaked data belonging to the CSJM unit of the Académie de Montpellier. This announcement, posted on May 5, 2026, suggests that the group has successfully accessed the institution's network and exfiltrated sensitive information.

The details of the claimed attack

According to the claim made by the Medusalocker group, the cyberattack targeted the CSJM (Beziers) unit of the Académie de Montpellier. The group asserts that they have obtained access to data that was allegedly exfiltrated from the institution's internal network. By listing the institution on their dedicated leak site, the group aims to exert significant pressure on the organization to meet their demands.

The group's methodology typically involves a double-extortion strategy. In such scenarios, threat actors do not merely encrypt an organization's files to disrupt operations; they also steal sensitive data beforehand. The threat of publicly releasing this stolen information serves as a powerful tool for extortion, forcing the victim to choose between paying a ransom or facing the reputational and legal consequences of a public data leak.

Compromised data and contents

The announcement provided by the Medusalocker group claims that specific credentials belonging to various personnel have been compromised. While the group has shared a screenshot showing a folder structure labeled 'sorted', there is no detailed inventory available regarding the specific contents or the full scope of the data stolen. No information was provided regarding the total size of the data or the specific number of files involved.

The listing specifically claims that the following types of data have been affected:

• Teacher credentials
• Administrative staff credentials

The exposure of such credentials poses a significant risk, as they can be used to gain further unauthorized access to internal systems or to impersonate legitimate users within the institutional network.

About the Académie de Montpellier

The Académie de Montpellier is a public institution located in the Occitanie region of France. It holds the responsibility of managing educational services within the region. The institution's scope of work includes the administrative and pedagogical supervision of various educational institutions, specifically overseeing primary and secondary education throughout the area.

Implications and security considerations

This incident highlights the potential risks faced by the education sector regarding the security of sensitive personnel data. The allegedly compromised information, particularly the credentials of teachers and administrative staff, could potentially facilitate targeted phishing attacks or identity theft attempts against the individuals working within the institution. Such attacks often leverage stolen credentials to increase their credibility and success rate.

Because the Académie de Montpellier is located in France, this incident may have significant legal implications under the European Union's General Data Protection Regulation (GDPR), which governs the protection of personal data and sets strict requirements for how organizations must handle and report breaches. While public information regarding the specific operations and methods of the Medusalocker group remains limited, their actions underscore the ongoing threat posed by ransomware groups to public institutions.

For organizations operating within the education sector, maintaining robust security postures is essential to prevent such breaches. Common defensive steps often include implementing multi-factor authentication to protect credentials, conducting regular security awareness training to mitigate phishing risks, and ensuring rigorous data encryption and monitoring protocols are in place. In the event of a confirmed breach, organizations typically must work to restore the security of their personnel data and fulfill legal obligations, which may include notifying the affected individuals.