ENA Tunisie: 85,344 student records published on DarkForums

<p>On 26 July 2026, a user identified as <strong>N0ull-0X</strong> published a database file on the Russian-language forum <strong>DarkForums.ru</strong> containing the records of <strong>85,344 applicants</strong> to the entrance examination portal of Tunisia's <strong>Ecole Nationale d'Administration (ENA)</strong>.</p> <h2>What was published</h2> <p>The post, titled "Tunisia Database www.ena.tn / concours.ena.tn", consists of a single CSV file with <strong>26 columns</strong> per record. Our team inspected a sample of the data:</p> <ul> <li><code>id</code>, <code>nom</code>, <code>prenom</code>, <code>email</code>, <code>genre</code>, <code>adresse</code></li> <li><code>telephone</code>, <code>numero_cin</code> (national identity card number)</li> <li><code>date_naissance</code>, <code>lieu_cin</code>, <code>empreint_cin</code></li> <li><code>moyenne1</code> through <code>moyenne4</code> (exam scores)</li> <li><code>moyenne_bac</code> (baccalaureate average), <code>moyenneglobal</code></li> <li><code>score</code>, <code>code_concour</code>, <code>code_specialite</code>, <code>code_etablissement</code></li> <li><code>annee_diplome1</code> through <code>annee_diplome4</code></li> <li><code>date_saisie</code>, <code>diplome</code>, <code>code_etat</code></li> </ul> <p>The file is unencrypted CSV, ready to open in any spreadsheet application. The records span diploma years from <strong>2007 to 2025</strong> (19 academic years).</p> <h2>What the poster did not say</h2> <p>N0ull-0X provided no narrative, no ransom demand, and no claim of affiliation with any group. The thread contains only the raw database file. No explanation was given for how the data was obtained.</p> <h2>Risks for affected individuals</h2> <p>The combination of data fields in this leak creates serious risks:</p> <ul> <li><strong>Identity theft</strong> - <code>numero_cin</code> combined with full names, dates of birth, and home addresses is sufficient to impersonate victims in Tunisian administrative procedures</li> <li><strong>Targeted phishing</strong> - verified email addresses and phone numbers linked to real identities, academic institutions, and years of study enable highly specific social engineering</li> <li><strong>Physical exposure</strong> - home addresses linked to full names expose students and their families to stalking or harassment</li> </ul> <h2>What remains unknown</h2> <ul> <li>How the database was accessed and extracted from the ENA portal</li> <li>Whether the full database was published or only a subset</li> <li>Whether other ENA systems were affected</li> <li>The date of the breach (the publication date does not establish when exfiltration occurred)</li> <li>The identity of the attacker (only the forum pseudonym N0ull-0X is known)</li> <li>Whether ENA or Tunisian authorities (INPDP) have been notified</li> </ul> <h2>Conclusion</h2> <p>Students who applied to the ENA entrance examination between 2007 and 2025 should consider their CIN number, home address, phone number, and academic records compromised. Affected individuals should monitor for phishing attempts using their ENA enrollment details, report any suspicious use of their identity documents to Tunisian authorities, and be alert to social engineering attempts impersonating ENA or government bodies.</p>