Loading story…
France’s data protection authority, CNIL, imposed a €1.7 million ($2 million) fine on the software company Nexpublica France following a data breach that exposed sensitive documents of third parties through a company portal. The breach, reported in November 2022, allowed users to access documents belonging to other individuals, prompting an investigation by CNIL, which found that Nexpublica’s data security program was insufficient and failed to meet basic security standards.
The regulator cited several aggravating factors in determining the fine, including Nexpublica’s lack of awareness of fundamental security principles, the number of people affected, the sensitivity of the exposed data, and the company’s financial capacity. CNIL also noted that Nexpublica was aware of the security issues prior to the breach but did not take corrective action until after the incident, constituting a violation of the General Data Protection Regulation (GDPR).
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
CNIL imposed a €1.7 million fine on Nexpublica France for inadequate cybersecurity practices tied to the breach, citing the company's financial capacity, poor basic security knowledge, the number of affected people, and the sensitivity of the exposed data.
Following its investigation, France's data protection regulator CNIL concluded that Nexpublica had known about the security weaknesses before the breach and only addressed them afterward, in violation of GDPR security requirements.
In November 2022, users of a Nexpublica France portal found they could access documents belonging to third parties, revealing a data breach affecting sensitive information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
France’s data-protection authority, CNIL, fined Hôpital privé de la Loire (HPL) **€500,000** over a 2025 breach in which an attacker used a compromised doctor’s account to access its electronic patient-record system. The incident exposed sensitive data for 524,867 patients and 202,246 trusted third parties—more than **727,000 people** in total. A person using the alias “Marak” claimed responsibility; three suspects were arrested in late June in connection with attacks on automated data-processing systems. CNIL found that HPL allowed remote access without a VPN or multifactor authentication, assigned overly broad permissions that enabled one compromised account to reach all patient records, and lacked monitoring capable of promptly detecting prolonged exploration and exfiltration. The authority also found that HPL failed to directly notify affected third parties, violating GDPR Articles 32 and 34. HPL has been ordered to correct the identified deficiencies within deadlines ranging from three to 15 months.
Sep 4, 2026
France’s data protection regulator **CNIL** issued a collective **€42 million** fine against Iliad Group subsidiaries **Free** and **Free Mobile** for **GDPR** violations tied to an October 2024 breach that exposed personal data for more than **24 million** individuals, including sensitive financial identifiers such as **IBANs**. CNIL cited the scale and sensitivity of the compromised data, as well as the companies’ profits, in setting penalties of **€27 million** for Free and **€15 million** for Free Mobile. Regulators said the intrusion was enabled by inadequate security controls, including a **weak VPN authentication process** and insufficient monitoring to detect anomalous activity. Reporting indicates the attacker accessed Free’s network via the corporate **VPN**, then reached Free Mobile’s subscriber management tool **MOBO**, which at the time allowed searches across both Free and Free Mobile customer datasets; exfiltration reportedly began in early October 2024 after initial access in late September. CNIL also faulted the companies for **insufficient breach communications** to impacted customers and for **improper data retention** (including retaining former subscribers’ data), while noting remediation steps have been initiated and further security improvements were ordered.
Jun 29, 2026
France’s data protection authority **CNIL** fined public employment agency **France Travail** €5 million for failing to implement security measures appropriate to the risk (citing **GDPR Article 32**) after attackers accessed job-seeker data via **social engineering**. Investigators said the attackers compromised accounts used by staff at **Cap emploi** (a partner organization), and that existing safeguards did not sufficiently reduce the risk of unauthorized access through compromised accounts. The intrusion enabled access to personal data associated with roughly **43 million** people, including current registrants, former registrants going back about **20 years**, and individuals with candidate profiles on `francetravail.fr`. Exposed data included **social security/national insurance numbers**, names and dates of birth, and contact details (email, postal address, phone); reporting noted the breach did **not** include bank details or account passwords and did not provide complete job-seeker files. CNIL ordered France Travail to provide evidence and a schedule of corrective actions, backed by a conditional **€5,000/day** penalty for non-compliance.
Jun 29, 2026