Loading story…
France’s data protection authority CNIL fined France Travail €5 million after finding the agency failed to adequately protect job seekers’ personal data in a major breach. Investigators said attackers used social engineering to compromise CAP EMPLOI adviser accounts and access France Travail’s information system, exposing data tied to people currently or previously registered over the past 20 years, as well as users with candidate accounts on francetravail.fr. The exposed information included national insurance or social security numbers and contact details, while complete job seeker files containing potentially sensitive health data were reportedly not accessed.
CNIL said the agency had inadequate authentication controls, insufficient logging to detect abnormal behavior, and overly broad access permissions, despite having already identified many of the needed safeguards. Alongside the fine, the regulator ordered France Travail to document corrective actions and provide a precise remediation timetable or face a penalty of €5,000 per day for delay. The case follows earlier scrutiny of the agency, formerly known as Pôle emploi, after a separate service-provider breach linked to the mass exploitation of MOVEit exposed data on roughly 10 million people, including names and French social security numbers.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-01-22, France's data protection authority CNIL fined France Travail €5 million for inadequate security measures tied to the 2024 breach. CNIL also ordered the agency to document corrective actions and an implementation schedule, with a potential €5,000-per-day penalty for delay.
In the first quarter of 2024, attackers used social engineering to compromise CAP EMPLOI adviser accounts and gain access to France Travail's information system. They accessed data on current and former registrants from the prior 20 years, as well as candidate-account holders, including national insurance numbers and contact details.
On or before 2023-08-25, Pôle emploi announced that a breach involving one of its service providers may have exposed the personal data of roughly 10 million job seekers and former users. Exposed data included names and French social security numbers, while passwords, banking data, email addresses, and phone numbers were reportedly not affected.
By mid-June 2023, U.S. officials disclosed that a global hacking campaign exploiting MOVEit software had exposed personal data belonging to millions of Americans through multiple federal agencies and contractors. The campaign was later broadly attributed to the Clop ransomware operation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcebleepingcomputer.com
Open sourcecnn.com
Open sourcecnil.fr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
France’s data protection authority **CNIL** fined public employment agency **France Travail** €5 million for failing to implement security measures appropriate to the risk (citing **GDPR Article 32**) after attackers accessed job-seeker data via **social engineering**. Investigators said the attackers compromised accounts used by staff at **Cap emploi** (a partner organization), and that existing safeguards did not sufficiently reduce the risk of unauthorized access through compromised accounts. The intrusion enabled access to personal data associated with roughly **43 million** people, including current registrants, former registrants going back about **20 years**, and individuals with candidate profiles on `francetravail.fr`. Exposed data included **social security/national insurance numbers**, names and dates of birth, and contact details (email, postal address, phone); reporting noted the breach did **not** include bank details or account passwords and did not provide complete job-seeker files. CNIL ordered France Travail to provide evidence and a schedule of corrective actions, backed by a conditional **€5,000/day** penalty for non-compliance.
Jun 29, 2026
France Titres, the French agency formerly known as ANTS and responsible for identity and registration documents, confirmed a breach of its `ants.gouv.fr` portal after threat actor **breach3d** advertised a trove of stolen records for sale on cybercrime forums. The agency said the compromised data may include login IDs, full names, email addresses, dates and places of birth, account identifiers, and in some cases postal addresses and phone numbers from both individual and professional accounts. Other reporting on the sale listings said the dataset could contain 18 million to 19 million records, including fields indicating government-verified identities, raising the risk of phishing, social engineering, and identity fraud if the claims are fully accurate. French authorities said unusual activity was identified in mid-April and launched parallel technical and judicial investigations involving **ANSSI**, **CNIL**, the Paris Public Prosecutor, and anti-cybercrime investigators. Prosecutors later announced the arrest of a 15-year-old suspect in connection with the case after records linked to the agency were allegedly offered for sale online, and said the inquiry covers unauthorized access, persistence, and extraction of personal data from a state-operated system. France Titres has notified affected individuals and said the stolen information does not provide direct access to user accounts or the portal itself, while warning citizens to remain alert for follow-on scams and impersonation attempts.
Jun 29, 2026
France’s data protection authority, CNIL, imposed a €1.7 million ($2 million) fine on the software company Nexpublica France following a data breach that exposed sensitive documents of third parties through a company portal. The breach, reported in November 2022, allowed users to access documents belonging to other individuals, prompting an investigation by CNIL, which found that Nexpublica’s data security program was insufficient and failed to meet basic security standards. The regulator cited several aggravating factors in determining the fine, including Nexpublica’s lack of awareness of fundamental security principles, the number of people affected, the sensitivity of the exposed data, and the company’s financial capacity. CNIL also noted that Nexpublica was aware of the security issues prior to the breach but did not take corrective action until after the incident, constituting a violation of the General Data Protection Regulation (GDPR).
Jun 29, 2026