Egidio

The Threat Laboratory → Aix-Marseille University

🌐 Français

Case file · August 24, 2026

Aix-Marseille: 84,000 students targeted, fake €450 tuition fee

Over roughly two weeks in August 2026, an email phishing campaign targeted all 84,000 students of Aix-Marseille University, demanding €450 in fake tuition fees. The university confirmed the campaign but flatly denied any hack of its own systems.

✅ Confirmed by the university itself — but it's not a hack. Aix-Marseille University publicly stated that the fraudulent messages came from addresses outside the institution: no staff mailbox was compromised. This is a standard email impersonation scheme, not an intrusion into the university's systems.

The numbers

84,000
Aix-Marseille University students targeted by the campaign, per French outlet franceinfo.
franceinfo.
€450
Amount demanded in the fake email, framed as urgent tuition or enrollment fees.
franceinfo, ICI, ZATAZ.
≈ 15 days
Duration of the campaign, spread over roughly two weeks before it received wide press coverage.
French press, including a TF1 evening news report.
0
Actual payment publicly confirmed by a student at the time of writing.
franceinfo, checked August 24, 2026.

Timeline

CONFIRMED
Early August 2026
The first fake emails, reproducing Aix-Marseille University's official logo and administrative wording, start circulating among students.
CONFIRMED
August 12, 2026
The university sends a warning email to all its students, and puts internal measures in place to limit the spread and forwarding of the fraudulent messages.
CONFIRMED
Mid-to-late August 2026
National (franceinfo) and regional (ICI Provence-Alpes-Côte d'Azur, ZATAZ) press document the campaign. A report airs on TF1's 8 PM evening news.

🔍A telltale sign: the grammar mistake

One version of the message spotted by the press contained a characteristic grammar error in the French text. This kind of mistake — a missing agreement, an awkward phrase — remains one of the most reliable signals of a fraudulent message, even when the logo and formatting look polished.

Source: franceinfo.

What this means for you

The rule that protects against this kind of campaign is simple and universal: never pay tuition, enrollment, or administrative fees via a link received by email, however urgent it appears. Any amount claimed by an institution should be verified directly on its official portal, by typing the address yourself rather than clicking a link. This applies to Aix-Marseille as much as to any other institution — the same mechanism (official logo, urgency, payment request) is reusable against any university or organization.

🔒 A message combining an official logo, urgent tone, and an immediate payment request should always be verified outside the channel it arrived through — never by following the link it contains.

Frequently asked questions

Was Aix-Marseille University hacked?

No, according to the institution: the messages came from outside addresses, not a compromised staff mailbox.

Did any students pay the €450 demanded?

No public information confirms an actual payment at the time of writing.

How can you spot this kind of fake email?

Official logo, administrative wording, urgent tone — and sometimes a telltale grammar mistake. The reliable rule: never pay via a link received by email.

📌 Last checked: August 24, 2026. Verifiable information to report: contact@egidio.app.

Related reading

Emerging phishing techniques From leak to scam Klark.ai: up to 500,000 people potentially exposed All our sources
Cite this page Egidio — The Threat Laboratory, "Aix-Marseille: 84,000 students targeted, fake €450 tuition fee," egidio.app/en/laboratoire/aix-marseille-university-tuition-phishing/. Licensed CC BY 4.0.

Free to reuse, including commercially, with attribution. Reuse terms.