Leak at France Travail

On 22 July 2025, France Travail — France's national public employment agency (formerly Pôle Emploi) — notified users that an unauthorized intrusion had exposed the personal data of roughly 340,000 job seekers. The compromise was traced to Kairos, the platform France Travail uses with partner training organizations, and was flagged to the agency by CERT-FR (ANSSI) after activity detected around 12–13 July.

The attack was not a direct breach of France Travail's core systems. Instead, attackers abused a legitimate user account belonging to a training organization based in the Isère department, whose credentials had been stolen by infostealer malware. Using that compromised partner access, they were able to query and extract jobseeker records through Kairos.

Exposed data categories:

• First and last name
• Date of birth
• France Travail identifier
• Email and postal address
• Phone number
• Jobseeker status

France Travail stated that passwords and banking details were not affected. As an immediate response, the agency temporarily took its "employment" portal and Kairos offline (services restored around 24 July), filed a criminal complaint, notified the CNIL under the GDPR, and accelerated the rollout of two-factor authentication for Kairos — originally planned for later — to harden partner access. The CNIL opened an investigation and issued guidance to affected users on guarding against phishing and identity fraud. This was a separate, smaller incident from the much larger March 2024 France Travail/Cap Emploi breach.