France Éducation International – Privacy Breach Notification
Surrey Schools has been notified by France Éducation International (FEI) of a cybersecurity incident involving FEI’s GAEL platform, which is used worldwide to administer registrations for the Diplôme d’Études en Langue Française (DELF) examinations.
When did this occur and how is this incident being handled?
FEI has advised that unauthorized access to the GAEL system occurred between January 9 and January 12, 2026. As of January 26, 2026, FEI has confirmed that the breach has been contained and that the GAEL platform has been restored to service. FEI has advised that additional security measures have been implemented to reduce the risk of a similar incident occurring in the future.
What kind of information was impacted?
The incident may affect candidate records dating back to 2005 and is estimated to involve approximately 5.8 million individuals globally. Information in these records, generally considered lower risk, may include first name, last name, year of birth, country and city of birth, language spoken at home and DELF registration centre location.
What steps have been taken by Surrey Schools and were any Surrey Schools students impacted?
In accordance with its obligations under the Freedom of Information and Protection of Privacy Act (FIPPA), Surrey Schools has reported this privacy breach to the Office of the Information and Privacy Commissioner for British Columbia (OIPC). Surrey Schools is currently reviewing the information provided by FEI to determine whether any current or former Surrey Schools students were affected and, if so, to assess the nature and extent of the impact.
Who can I contact for more information?
- Surrey Schools Privacy Office: privacy@surreyschools.ca
- Office of the Information and Privacy Commissioner for BC: info@oipc.bc.ca
What can I do to stay safe?
Surrey Schools encourages individuals who may have participated in the DELF program to remain vigilant and alert to suspicious or unexpected communications. As a precaution, individuals should:
- Avoid responding to unsolicited requests for personal information or documentation
- Be cautious of messages that convey urgency or claim to be from an “official” source
- Verify the identity of any individual or organization requesting information
- Avoid clicking on links or opening attachments from unknown or untrusted sources
