Leak at Pajemploi

On 17 November 2025, Pajemploi — the Urssaf-run public service French households use to declare and pay registered childcare assistants and in-home nannies — disclosed that it had been the victim of a data theft. The breach affected the personal data of employees (the childcare workers themselves), not their employers, with up to 1.2 million people potentially concerned.

The way the attackers gained access to the system has not been publicly disclosed. Urssaf stated that the incident had no impact on the operation of the Pajemploi service and did not disrupt the processing of declarations or salary payments.

The exposed data was limited to identity and administrative records. According to Urssaf, the following categories were potentially extracted:

• First and last name
• Social security number
• Date and place of birth
• Postal address
• Name of the banking institution
• Pajemploi number and accreditation (agrément) number

Crucially, Urssaf confirmed that bank account numbers (IBAN), email addresses, phone numbers and login passwords were not compromised.

Urssaf notified France's data-protection authority (CNIL) and the national cybersecurity agency (ANSSI), launched an internal investigation and indicated that a criminal complaint would be filed. Affected individuals were to be contacted individually and urged to remain vigilant against potential identity-theft and fraud attempts.