Loading story…
Pajemploi, a French social security service under URSSAF that supports parents and home-based childcare providers, has suffered a significant data breach impacting approximately 1.2 million professional caregivers. The breach, detected on November 14, resulted in the theft of personal data including full names, places of birth, postal addresses, social security numbers, names of banking institutions, Pajemploi numbers, and accreditation numbers. However, sensitive information such as bank account numbers (IBANs), email addresses, phone numbers, and account passwords were not accessed. Pajemploi has assured that its operational services remain unaffected and has taken immediate steps to secure its systems, while also notifying the French Data Protection Authority (CNIL) and the National Agency for the Security of Information Systems (ANSSI).
All affected individuals will be notified directly by Pajemploi, and the agency has advised heightened vigilance against potential fraudulent communications. The breach specifically targets employees of private employers using the Pajemploi service, raising concerns about the risk of identity theft and social engineering attacks. URSSAF has recommended that users remain alert for suspicious emails or SMS messages that could exploit the exposed data.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
French agency Pajemploi reported a data breach that exposed information belonging to about 1.2 million people. Multiple outlets covered the same disclosure, with no additional distinct developments provided in the references.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
French education authorities disclosed two significant breaches affecting both public and Catholic school administration systems. The Ministry of National Education said its `Compass` platform, used to manage trainee teachers in primary and secondary education, was compromised after a user reportedly opened a fraudulent email attachment and had credentials stolen. The incident exposed data on about **243,000 people**, including identity and contact details, absence periods, and the identities and professional phone numbers of tutors, though the ministry said no health data was involved. ANSSI was brought in, a crisis cell was opened, and the ministry announced a security plan centered on **multi-factor authentication**, stronger data segmentation, and reduced application exposure. Separately, the Secrétariat général de l’enseignement catholique reported a cyberattack on its management application for nursery and elementary schools that affected about **1.5 million people**. Unauthorized access exposed identification data for application users and contact information for students, families, and teachers, including names, postal and email addresses, phone numbers, and dates of birth, increasing the risk of phishing. The organization said it secured access, suspended affected services, notified authorities including the French Ministry of Education, and engaged specialist responders, while a forum user calling themselves **"Ryolait"** allegedly offered the stolen database for sale starting at **$2,000**. The incidents add to mounting concern over weak security in the education sector, which ANSSI has described as a frequent target of opportunistic attacks.
Jun 29, 2026
France’s data protection authority **CNIL** fined public employment agency **France Travail** €5 million for failing to implement security measures appropriate to the risk (citing **GDPR Article 32**) after attackers accessed job-seeker data via **social engineering**. Investigators said the attackers compromised accounts used by staff at **Cap emploi** (a partner organization), and that existing safeguards did not sufficiently reduce the risk of unauthorized access through compromised accounts. The intrusion enabled access to personal data associated with roughly **43 million** people, including current registrants, former registrants going back about **20 years**, and individuals with candidate profiles on `francetravail.fr`. Exposed data included **social security/national insurance numbers**, names and dates of birth, and contact details (email, postal address, phone); reporting noted the breach did **not** include bank details or account passwords and did not provide complete job-seeker files. CNIL ordered France Travail to provide evidence and a schedule of corrective actions, backed by a conditional **€5,000/day** penalty for non-compliance.
Jun 29, 2026
France’s data protection authority **CNIL** fined **France Travail** €5 million after finding the agency failed to adequately protect job seekers’ personal data in a major breach. Investigators said attackers used social engineering to compromise **CAP EMPLOI** adviser accounts and access France Travail’s information system, exposing data tied to people currently or previously registered over the past 20 years, as well as users with candidate accounts on `francetravail.fr`. The exposed information included national insurance or social security numbers and contact details, while complete job seeker files containing potentially sensitive health data were reportedly not accessed. CNIL said the agency had inadequate authentication controls, insufficient logging to detect abnormal behavior, and overly broad access permissions, despite having already identified many of the needed safeguards. Alongside the fine, the regulator ordered France Travail to document corrective actions and provide a precise remediation timetable or face a penalty of **€5,000 per day** for delay. The case follows earlier scrutiny of the agency, formerly known as **Pôle emploi**, after a separate service-provider breach linked to the mass exploitation of **MOVEit** exposed data on roughly 10 million people, including names and French social security numbers.
Jun 29, 2026