France Travail breach exposes data on up to 43 million job seekers

France Travail, the French national employment agency formerly known as Pole Emploi, disclosed on March 13, 2024 that attackers had extracted personal data on as many as 43 million people. The agency said the intrusion ran from February 6 to March 5, 2024 and covered anyone registered with it over the previous 20 years, along with holders of candidate profiles on its site.

The exposed information included full names, dates of birth, French social security numbers, France Travail identifiers, email addresses, postal addresses and telephone numbers. The agency said passwords and banking details were not compromised.

According to Infosecurity Magazine, the attackers first reached the systems of Cap Emploi, a linked employment service, around February 6 by impersonating a civil service officer, then used that access to move into France Travail. Suspicious activity was detected days later. France Travail notified the French data protection authority CNIL on March 8, and CNIL opened an investigation into whether the agency had met its obligations under the GDPR.

Paris authorities announced on March 19, 2024 that three suspects aged 21 to 23, all based in France, had been arrested on charges including fraudulent access to and maintenance of an automated data processing system. SecurityWeek noted that no known cybercrime group had taken credit for the intrusion.