France Éducation international - Cybersecurity incident (DELF and DALF)

Dear PGCPS Community, 

Prince George’s County Public Schools (PGCPS) is writing to inform our community of a data security incident involving France Éducation International, the organization that administers DELF/DALF French‑language proficiency examinations for our Immersion Office. On January 12, 2026, France Éducation International notified PGCPS that its GAEL platform experienced unauthorized access resulting in the exfiltration of certain student information (name, DOB, nationality) between January 9 and January 12, 2026. Upon receiving this notification, France Éducation International, immediately suspended access to the platform as a precaution and began coordinating with cybersecurity specialists to understand the nature and scope of the incident. France Éducation International subsequently implemented additional security measures and restored platform access on January 26, 2026. PGCPS has since identified which students’ information was potentially involved, confirmed the categories of affected data, and completed required documentation under the Family Educational Rights and Privacy Act (FERPA). Notification letters are being sent to families of affected students, and this public notice provides the same information for individuals for whom PGCPS does not have current contact information.

Notice of Data Event

What Happened?

On January 12, 2026, Prince George’s County Public Schools (PGCPS) was notified by France Éducation International—our vendor for DELF/DALF French‑language proficiency examinations—of a data security incident involving its GAEL platform. A forensic investigation determined that an unauthorized actor accessed the GAEL system and exfiltrated certain student information between January 9 and January 12, 2026. Upon receiving this notification, France Éducation International suspended access to the platform as a precaution and began working with outside cybersecurity specialists to confirm the nature and scope of the incident. France Éducation International subsequently implemented additional security measures and restored platform access on January 26, 2026. After receiving the vendor’s findings, we conducted a comprehensive review to determine which students’ information was potentially involved and what categories of data were affected. Once the scope of the incident was confirmed, we initiated efforts to identify and contact affected families, update student education records in accordance with FERPA, and provide this direct notice to individuals for whom PGCPS does not have current contact information.

What Information Was Involved?

The information present in the files that may have been viewed or acquired as a result of this incident varies per person, and includes individuals’ full name, date of birth, city & country of origin, nationality, and affiliated examination center. 

What We Are Doing.

We treat our responsibility to safeguard the information entrusted to us as an utmost priority. As such, we responded immediately to this incident and have been working diligently to provide you with an accurate and complete notice of the incident. We have also implemented additional processes and procedures to help prevent similar incidents from occurring in the future.      

How Will Individuals Know If They Are Affected By This Incident?

We are mailing a notice letter to individuals whose information was determined to be in the affected files, for whom we have a valid mailing address. 

If you have any questions, please contact Immersion.Programs@pgcps.org.

What You Can Do.

We encourage you to remain vigilant against incidents of identity theft and fraud by reviewing your account statements regularly and monitoring your free credit reports for suspicious activity and to detect errors. As a precaution, France Éducation International advises those who may have been affected to be particularly vigilant if they receive unexpected or suspicious communications or messages. Individuals should:

• Avoid responding to unsolicited requests for personal information or documentation
• Be cautious of messages that convey urgency or claim to be from an “official” source
• Verify the identity of any individual or organization requesting information
• Avoid clicking on links or opening attachments from unknown or untrusted sources

France Éducation International has  set up an online Frequently Asked Questions section for the most up-to-date information about the incident. The FAQ says they have met all necessary safety conditions to reopen the GAEL platform. If you or your child has taken the DELF exam since 2005, you are advised to be especially cautious of unexpected or suspicious messages.

Under U.S. law, a consumer is entitled to one free credit report annually from each of the three major credit reporting bureaus, Equifax, Experian, and TransUnion. To order a free credit report, visit www.annualcreditreport.com or call, toll-free, 1-877-322-8228. Consumers may also directly contact the three major credit reporting bureaus listed below to request a free copy of their credit report.

Consumers have the right to place an initial or extended “fraud alert” on a credit file at no cost. An initial fraud alert is a 1-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If consumers are the victim of identity theft, they are entitled to an extended fraud alert, which is a fraud alert lasting seven years. Should consumers wish to place a fraud alert, please contact any of the three major credit reporting bureaus listed below.

As an alternative to a fraud alert, consumers have the right to place a “credit freeze” on a credit report, which will prohibit a credit bureau from releasing information in the credit report without the consumer’s express authorization. The credit freeze is designed to prevent credit, loans, and services from being approved in a consumer’s name without consent. However, consumers should be aware that using a credit freeze to take control over who gets access to the personal and financial information in their credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application they make regarding a new loan, credit, mortgage, or any other account involving the extension of credit. Pursuant to federal law, consumers cannot be charged to place or lift a credit freeze on their credit report. To request a credit freeze, individuals may need to provide some or all of the following information: 

1. Full name (including middle initial as well as Jr., Sr., II, III, etc.);
2. Social Security number;
3. Date of birth;
4. Addresses for the prior two to five years;
5. Proof of current address, such as a current utility bill or telephone bill;
6. A legible photocopy of a government-issued identification card (state driver’s license or ID card, etc.); and
7. A copy of either the police report, investigative report, or complaint to a law enforcement agency concerning identity theft if they are a victim of identity theft.

Should consumers wish to place a credit freeze or fraud alert, please contact the three major credit reporting bureaus listed below:

Additional Information

Consumers may further educate themselves regarding identity theft, fraud alerts, credit freezes, and the steps they can take to protect your personal information by contacting the consumer reporting bureaus, the Federal Trade Commission, or their state Attorney General. The Federal Trade Commission may be reached at: 600 Pennsylvania Avenue NW, Washington, D.C. 20580; www.identitytheft.gov; 1-877-ID-THEFT (1-877-438-4338); and TTY: 1-866-653-4261. The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them. Consumers can obtain further information on how to file such a complaint by way of the contact information listed above. Consumers have the right to file a police report if they ever experience identity theft or fraud. Please note that in order to file a report with law enforcement for identity theft, consumers will likely need to provide some proof that they have been a victim. Instances of known or suspected identity theft should also be reported to law enforcement and the relevant state Attorney General. 

For District of Columbia residents, the District of Columbia Attorney General may be contacted at: 400 6th Street, NW, Washington, D.C. 20001; 202-727-3400; and oag.dc.gov.

For Maryland residents, the Maryland Attorney General may be contacted at: 200 St. Paul Place, 16th Floor, Baltimore, MD 21202; 1-410-576-6300 or 1-888-743-0023; and https://www.marylandattorneygeneral.gov/. You may write to PGCPS at 1401 School Lane, Upper Marlboro, MD 20772.