Leak at Caisse des dépôts et des consignations

On 12 February 2025, the Caisse des dépôts et des consignations — the French state-owned financial institution that manages public pension and savings schemes — disclosed a data breach affecting the Ircantec supplementary retirement fund it operates on behalf of public employers. Attackers used fraudulently obtained login credentials to access the Ircantec management platform and exfiltrate the personal data of roughly 70,000 affiliates.

Those affected were largely contract workers across the state, territorial and hospital public services, along with hospital practitioners and about 1,000 local elected officials affiliated with the scheme. The intrusion relied on stolen account credentials rather than any modification of the underlying records.

The exposed data included:

• First and last names
• Dates and places of birth
• Social security numbers
• Postal addresses

According to the Caisse des dépôts, banking details and telephone numbers were not affected and no records were altered. In response, the institution blocked the compromised access, tightened account-creation controls, alerted partner organisations to watch for abnormal activity, notified all affected individuals, reported the breach to the data-protection regulator CNIL, and filed a criminal complaint.