Loading story…
France’s data protection authority CNIL fined public employment agency France Travail €5 million for failing to implement security measures appropriate to the risk (citing GDPR Article 32) after attackers accessed job-seeker data via social engineering. Investigators said the attackers compromised accounts used by staff at Cap emploi (a partner organization), and that existing safeguards did not sufficiently reduce the risk of unauthorized access through compromised accounts.
The intrusion enabled access to personal data associated with roughly 43 million people, including current registrants, former registrants going back about 20 years, and individuals with candidate profiles on francetravail.fr. Exposed data included social security/national insurance numbers, names and dates of birth, and contact details (email, postal address, phone); reporting noted the breach did not include bank details or account passwords and did not provide complete job-seeker files. CNIL ordered France Travail to provide evidence and a schedule of corrective actions, backed by a conditional €5,000/day penalty for non-compliance.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
After CNIL's ruling, France Travail said it accepted the decision while arguing that the penalty was severe despite cybersecurity efforts made since the incident. The statement served as the agency's official response to the enforcement action.
Alongside the fine on January 29, 2026, CNIL ordered France Travail to document and implement corrective security measures within a set timeframe. The regulator said non-compliance could trigger a conditional daily penalty of €5,000.
On January 29, 2026, France's data protection authority CNIL fined France Travail €5 million for failing to adequately secure job seekers' personal data, citing GDPR Article 32 violations. CNIL said safeguards such as authentication, logging and monitoring, and access controls were insufficient to prevent or detect the compromise.
The early 2024 breach was found to have exposed personal information associated with about 43 million people, including names, dates of birth, national insurance or social security numbers, and contact details. Reports said bank details, passwords, full job-seeker files, and health data were not taken.
In early 2024, attackers used social engineering to hijack accounts belonging to CAP EMPLOI advisers or related partner organizations, gaining unauthorized access to France Travail systems. The intrusion exposed personal data tied to current and former registrants over roughly 20 years.
In August 2023, France Travail experienced a separate data breach that reportedly affected about 10 million individuals. This earlier incident was later cited in coverage of the larger 2024 breach.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetherecord.media
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
France’s data protection authority **CNIL** fined **France Travail** €5 million after finding the agency failed to adequately protect job seekers’ personal data in a major breach. Investigators said attackers used social engineering to compromise **CAP EMPLOI** adviser accounts and access France Travail’s information system, exposing data tied to people currently or previously registered over the past 20 years, as well as users with candidate accounts on `francetravail.fr`. The exposed information included national insurance or social security numbers and contact details, while complete job seeker files containing potentially sensitive health data were reportedly not accessed. CNIL said the agency had inadequate authentication controls, insufficient logging to detect abnormal behavior, and overly broad access permissions, despite having already identified many of the needed safeguards. Alongside the fine, the regulator ordered France Travail to document corrective actions and provide a precise remediation timetable or face a penalty of **€5,000 per day** for delay. The case follows earlier scrutiny of the agency, formerly known as **Pôle emploi**, after a separate service-provider breach linked to the mass exploitation of **MOVEit** exposed data on roughly 10 million people, including names and French social security numbers.
Jun 29, 2026
France Titres, the French agency formerly known as ANTS and responsible for identity and registration documents, confirmed a breach of its `ants.gouv.fr` portal after threat actor **breach3d** advertised a trove of stolen records for sale on cybercrime forums. The agency said the compromised data may include login IDs, full names, email addresses, dates and places of birth, account identifiers, and in some cases postal addresses and phone numbers from both individual and professional accounts. Other reporting on the sale listings said the dataset could contain 18 million to 19 million records, including fields indicating government-verified identities, raising the risk of phishing, social engineering, and identity fraud if the claims are fully accurate. French authorities said unusual activity was identified in mid-April and launched parallel technical and judicial investigations involving **ANSSI**, **CNIL**, the Paris Public Prosecutor, and anti-cybercrime investigators. Prosecutors later announced the arrest of a 15-year-old suspect in connection with the case after records linked to the agency were allegedly offered for sale online, and said the inquiry covers unauthorized access, persistence, and extraction of personal data from a state-operated system. France Titres has notified affected individuals and said the stolen information does not provide direct access to user accounts or the portal itself, while warning citizens to remain alert for follow-on scams and impersonation attempts.
Jun 29, 2026
France’s data protection authority, CNIL, imposed a €1.7 million ($2 million) fine on the software company Nexpublica France following a data breach that exposed sensitive documents of third parties through a company portal. The breach, reported in November 2022, allowed users to access documents belonging to other individuals, prompting an investigation by CNIL, which found that Nexpublica’s data security program was insufficient and failed to meet basic security standards. The regulator cited several aggravating factors in determining the fine, including Nexpublica’s lack of awareness of fundamental security principles, the number of people affected, the sensitivity of the exposed data, and the company’s financial capacity. CNIL also noted that Nexpublica was aware of the security issues prior to the breach but did not take corrective action until after the incident, constituting a violation of the General Data Protection Regulation (GDPR).
Jun 29, 2026