Leak at France Travail

On 6 October 2025, France Travail — France's national public employment agency (formerly Pôle Emploi) — was reported to have suffered another data leak, one of a string of incidents the agency disclosed throughout 2025. This particular event exposed the personal records of roughly 5,500 job seekers. It is distinct from the larger, separately documented France Travail breaches of 2025 (notably the ~31,000-account theft claimed by the Stormous group in late October and the July compromise affecting some 340,000 people).

Across France Travail's 2025 incidents, attackers did not breach the agency's core infrastructure directly. Instead, leaks stemmed from compromised credentials and access — typically harvested by infostealer malware on job seekers' personal devices or via abused partner/agent accounts — used to log into claimant spaces and extract user data. The exposed records were subsequently circulated on cybercrime channels.

The data exposed in this leak included:

• First and last name
• France Travail identifier
• Registration category
• Email address
• RSA (revenu de solidarité active) welfare status
• CIR identifier

Although banking details and passwords were not part of this particular set, the combination of identity data, contact details and benefits status creates a meaningful risk of targeted phishing and identity fraud. France Travail urged affected job seekers to stay vigilant against fraudulent messages. France's data protection authority, the CNIL, opened investigations into the agency's repeated 2025 breaches and, in January 2026, fined France Travail €5 million for failing to adequately protect job seekers' personal data.