Académie de Montpellier / CSJM Listed by medusalocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The Académie de Montpellier, a French public education authority, has been listed by the medusalocker ransomware group as a victim of a data breach. The listing, reported on 5 May 2026, indicates that internal files were taken during a ransomware incident affecting the network domain CSJM.BEZIERS. The number of individuals whose information may be involved remains unknown, and the organisation has not confirmed the extent of any exposure. This incident matters because the affected systems belong to a regional school network that holds records on staff and operations. Even without Reported Details on the volume or sensitivity of the material, any unauthorised access to education-sector systems can create lasting administrative and personal consequences for the people whose information appears in those files.

What happened

The incident involves the Académie de Montpellier network, specifically the CSJM.BEZIERS domain in the Occitanie region. The medusalocker group listed the organisation on its leak site and stated that internal files had been exfiltrated during a ransomware attack. No official confirmation of the listing or independent verification of the claimed data removal has been made public. The number of records involved and the precise date of the intrusion are not disclosed.

Who is medusalocker?

Medusalocker is a ransomware operator that has been publicly tracked since at least 2020. The group typically gains access through remote-desktop services or phishing, deploys encryption on victim systems, and exfiltrates selected files before demanding payment. It maintains a leak site where it lists organisations it claims to have targeted, often posting samples of data to pressure victims. The group’s listings constitute claims rather than independently verified incidents.

About Académie de Montpellier

The Académie de Montpellier is the regional education authority responsible for public schools in parts of the Occitanie region of France. It manages administrative systems for teaching and support staff across multiple establishments and maintains records required for payroll, human resources and school operations. Entities of this type routinely process employment and professional contact data for thousands of employees.

What data was at risk

The listing refers to internal files taken during the ransomware operation. The available information also notes teacher and administrative staff credentials. No further breakdown of file types, record counts or specific data fields has been released. Organisations in the French education sector commonly hold staff identifiers, professional contact details and system access information, but the exact contents of the exfiltrated material remain unconfirmed.

Why it matters

Staff credentials and internal files can be used for further unauthorised access or for social-engineering attempts against the same individuals or their colleagues. In an education setting, such exposure may also affect routine administrative processes that rely on those systems. Because the number of people involved is unknown, the practical impact cannot yet be quantified, but any confirmed credential exposure requires affected staff to treat their accounts as potentially compromised.

What to do if you're exposed

Anyone who works or has worked with the Académie de Montpellier or its associated domains should change passwords for any accounts that reuse credentials linked to the organisation and enable multi-factor authentication where available. Monitor official communications from the Académie for guidance. Individuals can also run a free exposure scan of their email address against known breach data to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.