Leak at France Travail

On 8 March 2024, France Travail — France's national public employment agency (formerly Pôle Emploi) — disclosed a major data breach affecting up to 43 million people, covering everyone registered with the agency over the previous 20 years as well as holders of candidate accounts on francetravail.fr.

The attackers gained access through social engineering: they impersonated or manipulated staff to hijack the accounts of advisers at Cap Emploi, the network of organisations that support employment for people with disabilities. Using these legitimate adviser credentials, they queried France Travail's information system and extracted personal records at scale.

The exposed data included:

• First and last names
• Dates of birth
• Social security (national insurance) numbers
• Email addresses
• Postal addresses
• Phone numbers
• France Travail identifiers

Complete jobseeker files — and in particular any health data — were not compromised, and no bank details or passwords were exposed. French police arrested three suspects (aged 21 to 23) in connection with the breach. The CNIL, France's data protection authority, opened an investigation and on 22 January 2026 fined France Travail €5 million, finding that the agency had failed to implement adequate authentication for Cap Emploi advisers, sufficient logging to detect abnormal activity, and appropriately restricted access permissions.