Hackers Expose 43 Million Records — Regulator Fines Government Agency €5 Million for Data Security Failures
Massive Job-Seeker Data Breach Triggers One of France’s Largest Privacy Penalties
France’s data protection regulator, National Commission on Informatics and Liberty (CNIL), has fined France Travail €5 million after a major cybersecurity failure exposed the personal data of 43 million job seekers.
France Travail, previously known as Pôle Emploi, manages unemployment benefits and employment services nationwide. As part of its operations, it stores highly sensitive personal and financial data spanning decades.
Scope of the Data Breach
The breach occurred in early 2024 and exposed records collected over 20 years, making it one of the most extensive data leaks involving a public-sector organization in France.
Compromised data included:
- Full names
- Dates of birth
- National insurance numbers
- Email addresses
- Home addresses
- Phone numbers
Notably, bank details and account passwords were not compromised, and complete job-seeker files containing medical information were not accessed.
How the Attack Happened
According to CNIL, attackers used social engineering techniques to exploit human trust rather than technical vulnerabilities. By impersonating legitimate users, they hijacked accounts belonging to advisers from partner organizations responsible for supporting individuals with disabilities.
This unauthorized access enabled attackers to extract large volumes of personal data without triggering adequate security controls.
Regulatory Action and Ongoing Risk
In addition to the €5 million fine, CNIL ordered France Travail to:
- Implement corrective cybersecurity measures
- Document remediation efforts
- Provide a detailed implementation timeline
Failure to comply will result in daily penalties of €5,000 until the agency proves that security weaknesses have been addressed.
Why This Matters for Organizations
This incident highlights a growing regulatory trend:
- Public and private organizations are equally accountable
- Human-factor attacks (social engineering) remain a critical risk
- Long-term data retention significantly amplifies breach impact
France Travail had already suffered another large breach in 2023 affecting 10 million individuals, raising serious concerns about systemic security governance.