CNIL Fines France Travail €5 Million After Social-Engineering Breach Exposed Job Seeker Data

France’s data protection authority CNIL fined public employment agency France Travail €5 million for failing to implement security measures appropriate to the risk (citing GDPR Article 32) after attackers accessed job-seeker data via social engineering. Investigators said the attackers compromised accounts used by staff at Cap emploi (a partner organization), and that existing safeguards did not sufficiently reduce the risk of unauthorized access through compromised accounts.

The intrusion enabled access to personal data associated with roughly 43 million people, including current registrants, former registrants going back about 20 years, and individuals with candidate profiles on francetravail.fr. Exposed data included social security/national insurance numbers, names and dates of birth, and contact details (email, postal address, phone); reporting noted the breach did not include bank details or account passwords and did not provide complete job-seeker files. CNIL ordered France Travail to provide evidence and a schedule of corrective actions, backed by a conditional €5,000/day penalty for non-compliance.