IFOCOP Data Breach: What's Reported, What to Do

In short: IFOCOP, a French vocational retraining organization with a training center in Montigny-le-Bretonneux, has reports circulating of a cyberattack. As of this writing, IFOCOP's own website carries no public breach notice, press release or incident page confirming the attack, naming what data was taken, or stating how many people are affected. If you've applied to, studied with, taught at or partnered with IFOCOP, it's worth acting now rather than waiting for confirmation.

IFOCOP calls itself France's leading professional retraining and apprenticeship organization on its own site. That means career-changers, apprenticeship students, staff and partner employers may all have handed over contact details and, potentially, a government ID number. With no official statement yet published, this piece focuses on what you can do right now and is plain about what remains unknown.

What should I do if my data was exposed in the IFOCOP breach?

Treat your contact details and any ID number you've shared with IFOCOP as potentially exposed, even before anything is officially confirmed:

1. Watch closely for unexpected contact. Be alert to texts, calls and emails from senders who reference personal information about you.
2. Don't click links in unexpected messages. Go to the official website directly, or call the sender's main number to double-check, rather than following a link in a text or email.
3. Never share one-time codes, passwords or card details with anyone who contacts you unexpectedly, even if they appear to know personal details about you.
4. Stop using a government ID number as a password. If you've ever used all or part of a national identification or social security number as a password anywhere, change it now.
5. Change passwords on any account tied to the email address or phone number you've given IFOCOP, especially if you reused that password elsewhere.
6. Monitor your bank accounts and credit activity directly. Report unfamiliar logins or loan applications to your bank immediately. If you live in Denmark, you can also register a free credit warning (kreditadvarsel) via Borger.dk, which makes it harder for someone to take out a loan in your name.
7. For more on spotting fraud attempts built from leaked data, see our guide on how to spot phishing emails using exposed data, and our general step-by-step what to do after a breach.

None of this requires waiting for IFOCOP to confirm anything. These steps cost nothing and hold up regardless of how the details eventually shake out. Public guidance on preventing identity theft after a leak, such as Sikkerdigital.dk's advice, points the same way.

What was exposed in the IFOCOP breach?

Nothing has been confirmed by IFOCOP itself. IFOCOP's website does not list any data categories as exposed, and no public statement from the organization addresses the reports. Until that changes, don't treat any specific claim about which fields were taken as verified — but don't dismiss it either, given the steps above cover you either way.

How many people were affected by the IFOCOP breach?

That number isn't known. No count of affected students, staff, alumni or partner organizations has been published by IFOCOP, and the organization's site carries no incident page where such a figure would normally appear.

How did the IFOCOP breach happen and who was responsible?

This is also not known. IFOCOP has not published any account of how an attack occurred, when exactly it took place, or who carried it out, and its website has no statement addressing either question. Whose records specifically were touched — students, staff, alumni or partner companies — hasn't been stated by the organization either. Until IFOCOP or an official body publishes something concrete, the honest answer to both questions is that nobody outside the organization knows, and the safest response is to follow the checklist above rather than wait.

If you've contacted IFOCOP directly and gotten no answer, or if you believe your data has been mishandled, French law gives you a fallback: anyone can adresser une réclamation (plainte) à la CNIL, the French data protection authority, once they've tried contacting the organization first. IFOCOP itself, as the organization handling the data, would be the one legally required to notify the CNIL of any confirmed breach within 72 hours of becoming aware of it, under the EU's GDPR rules as the CNIL explains — so a CNIL complaint is the main route available to you if that notification never surfaces.

For what to do next, see our step-by-step guide to handling any data breach, which covers freezing credit, documenting fraud attempts and tracking a company's eventual disclosure.

Updated 28 October 2026: Added guidance on filing a CNIL complaint if IFOCOP doesn't respond, plus a closing link to the site's full breach-response checklist.