1,431,906 members affected by a data leak at CFDT

On 18 February 2026, the CFDT — the Confédération française démocratique du travail, France's largest trade union confederation — confirmed it had been the victim of a cyberattack that led to the exfiltration of personal data belonging to its members.

According to the union's investigation, the attacker used the compromised credentials of a CFDT regional manager to reach the "Cnas" membership application and its database, then escalated beyond that account's normal access rights to extract records covering current members and many former members across the country. A threat actor going by the alias HexDex subsequently advertised the database for sale, claiming data on 1,431,906 members.

The exposed records included:

• First and last names
• Full postal addresses
• Union-affiliation details (membership number, membership date and affiliated union)

Roughly 13,026 personal or professional email addresses and 5,877 professional phone numbers belonging to staff and partners were also affected. The CFDT stated that no member phone numbers, email addresses, identity documents or banking and financial data were compromised.

Upon discovering the intrusion, the CFDT isolated and shut down the affected servers, notified members by email, and informed the CNIL and ANSSI while filing a criminal complaint. The incident appears contained, though the leaked data continued to circulate on underground forums.