France Travail Fined €5 Million After Breach Exposed Job Seeker Data

France’s data protection authority CNIL fined France Travail €5 million after finding the agency failed to adequately protect job seekers’ personal data in a major breach. Investigators said attackers used social engineering to compromise CAP EMPLOI adviser accounts and access France Travail’s information system, exposing data tied to people currently or previously registered over the past 20 years, as well as users with candidate accounts on francetravail.fr. The exposed information included national insurance or social security numbers and contact details, while complete job seeker files containing potentially sensitive health data were reportedly not accessed.

CNIL said the agency had inadequate authentication controls, insufficient logging to detect abnormal behavior, and overly broad access permissions, despite having already identified many of the needed safeguards. Alongside the fine, the regulator ordered France Travail to document corrective actions and provide a precise remediation timetable or face a penalty of €5,000 per day for delay. The case follows earlier scrutiny of the agency, formerly known as Pôle emploi, after a separate service-provider breach linked to the mass exploitation of MOVEit exposed data on roughly 10 million people, including names and French social security numbers.