ENKR

France Travail jobseeker data breach

Add to my breach check

Made public · 43,000,000 people, potentially

What leaked7

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address
  • Username

Permanent

  • National ID or tax number
  • Date of birth
  • Full name
  • National ID or tax numberFrench social security number
  • Mobile numberphone numbers
  • UsernameFrance Travail identifier

To-dos4 · about 50 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls
  3. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  4. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next12 events

  1. UndetectedNone on record
  2. Response 6 eventsNo individual notice on record · show events
  3. RemedyNone on record
  4. Penalty 5 eventsFine €5M · show events
  5. Disputes 1 eventOngoing · show events
  1. Order to show corrective measures on a set timetable, with a penalty of EUR 5,000 per day of delay
  2. CNIL restricted committee fined France Travail EUR 5 million for failing to secure jobseekers' data · GDPR Art. 32
  3. CNIL found weak authentication for Cap emploi advisers, insufficient logging and overly broad access rights; attackers reached data on everyone registered in the past 20 years but not full jobseeker files
  4. Three suspects arrested on 17 March were placed under formal investigation and in pre-trial detention · fraudulent system access, data extraction, fraud, money laundering, organised gang
  5. CNIL opened investigations into the security measures before and after the incident
7 more
  1. France Travail announced that the Paris prosecutor had opened a preliminary criminal investigation, assigned to the Paris cybercrime brigade, with a simplified complaint form for victims
  2. Additional access protection for partner (Cap emploi) logins announced
  3. Dedicated information line announced on the 39 49 phone service
  4. France Travail apologised to the people identified and said it would inform them by personal account or email
  5. France Travail filed a criminal complaint with the judicial authorities
  6. Press release: personal data of potentially 43 million people extracted; passwords and bank details not affected
  7. France Travail and Cap emploi notified the CNIL of an intrusion into their information systems
Company
France Travail
Made public
Notice
Leak confirmed
Affected
43,000,000 people, potentially · registered with France Travail or Pôle emploi in the past 20 years, or holding a candidate account on francetravail.fr; France Travail notice

How the facts developed

  1. CNIL decision: the attackers accessed data on everyone registered or registered in the past 20 years and on candidate-account holders, but not the full jobseeker files that may contain health data
  2. France Travail announced that data on potentially 43 million people had been extracted using accounts of Cap emploi advisers; passwords and bank details not affected

Sources