377,418 jobseekers - data leak at Choisir le service public

On 3 February 2026, Choisir le service public — the French state's central recruitment portal for public-sector jobs — disclosed a data breach affecting 377,418 registered candidates. The intrusion was traced to the fraudulent use of a manager (administrator) account, which gave the attackers access to the full pool of applicant files. The platform temporarily suspended candidate logins and application submissions for several days while it secured the site.

The exposed records consisted of the candidates' application profiles rather than account credentials. According to the platform's notice, no candidate passwords, CVs or other uploaded attachments were compromised.

The leaked data categories included:

• Identity details: surname, first name and date of birth
• Contact information: postal address, email address and phone number
• Education and academic history, including level of study
• Professional-project data: type of job sought, desired employment category, languages spoken and geographic preferences

The stolen database was reportedly put up for sale on the dark web, with information on roughly 1,000 victims published as a sample. The operator notified the CNIL and ANSSI, indicated it would file a criminal complaint, and warned candidates of an elevated risk of identity theft and highly targeted phishing built on their professional backgrounds. The platform was restored after the security measures, leaving the incident contained.