--- title: "France Travail job-seeker data incident" description: "Evidence-backed account of France Travail job-seeker data incident, covering what happened, impact, timeline, attack vector, technical details, and primary sources." incident_type: "Data incident" status: "active" last_modified: "2026-08-09" canonical_url: "https://www.ally.security/incidents/france-travail-job-seeker-data-incident-2024" markdown_url: "https://www.ally.security/incidents/france-travail-job-seeker-data-incident-2024.md" stix_url: "https://www.ally.security/incidents/france-travail-job-seeker-data-incident-2024/stix.json" --- # France Travail job-seeker data incident One or more attackers used social engineering to take over Cap emploi adviser accounts and access France Travail job-seeker data. Access to identity, employment-service account, national-insurance, and contact information for current and former registrants and candidate-account holders. Last modified Aug 9, 2026 · 2 sources ## Summary - **Environment:** Network whose adviser accounts were hijacked and used to reach France Travail data. - **Operational impact:** No outage or recovery duration quantified - **Financial impact:** No public cost estimate ## What happened One or more attackers used social engineering to take over Cap emploi adviser accounts and access [France Travail](https://www.francetravail.fr/) job-seeker data. [1](#source-1) ## Impact Access to identity, employment-service account, national-insurance, and contact information for current and former registrants and candidate-account holders. [1](#source-1) Documented data types include: - Contact information — Email addresses, postal addresses, and telephone numbers. [1](#source-1) [2](#source-2) - Usernames and account identifiers — France Travail identifiers; not asserted to include passwords. [1](#source-1) [2](#source-2) - Social Security numbers — French national-insurance numbers; mapped to the database's government social-insurance identifier category. [1](#source-1) [2](#source-2) - Names — Names and surnames. [1](#source-1) [2](#source-2) A cited record reports 43,000,000 individuals (Initial March 2024 CNIL estimate of people potentially affected; the source said the figure required confirmation and it is not a verified final count; as of 2024-03-13). [1](#source-1) [2](#source-2) The CNIL's March 2024 information said passwords and bank details were not affected; the later enforcement summary also said complete job-seeker files, which may include health data, were not accessed. [1](#source-1) [2](#source-2) ## Timeline ### March 8, 2024 — Public disclosure Date France Travail and Cap emploi informed the CNIL of the intrusion; not necessarily the first public announcement date. [2](#source-2) ### January 22, 2026 — Documented event Date the CNIL imposed the sanction. [1](#source-1) ### August 9, 2026 — Briefing updated This briefing was last reviewed and updated on August 9, 2026. ## Threat Group & Attack Vector The CNIL found Cap emploi adviser permissions were too broad and allowed access to people the advisers were not supporting, increasing the volume exposed to attackers. [1](#source-1) Social engineering was used to exploit trust or lack of awareness and take over Cap emploi adviser accounts; the source does not identify a more specific standardized technique. [1](#source-1) The attackers hijacked Cap emploi adviser accounts and used them to access the France Travail information system in the first quarter of 2024. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response The CNIL imposed a €5 million administrative fine on France Travail. The CNIL found logging measures were inadequate for detecting abnormal behavior on the information system. The CNIL found the authentication procedures used by Cap emploi advisers to access France Travail were not sufficiently robust. The CNIL ordered France Travail to justify corrective measures on a specified schedule, with a €5,000 daily penalty for delay. No access path, attribution, scale, or recovery detail is inferred beyond the cited claims. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Data breach: FRANCE TRAVAIL fined €5 million regulatory · Commission nationale de l'informatique et des libertés · Jan 29, 2026 ### France Travail : la CNIL enquête sur la fuite de données et donne des conseils pour se protéger regulatory · Commission nationale de l'informatique et des libertés · Mar 13, 2024
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** First-quarter 2024 France Travail account compromise: The CNIL found Cap emploi adviser permissions were too broad and allowed access to people the advisers were not supporting, increasing the volume exposed to attackers. 2. **Affected Organization · 100% confidence · current** CNIL proceeding SAN-2026-003 against France Travail: France Travail 3. **Resulted In · 100% confidence · current** CNIL proceeding SAN-2026-003 against France Travail: The CNIL imposed a €5 million administrative fine on France Travail. 4. **Resulted In · 100% confidence · current** France Travail job-seeker data exposure: The CNIL's March 2024 information said passwords and bank details were not affected; the later enforcement summary also said complete job-seeker files, which may include health data, were not accessed. 5. **Affected Organization · 100% confidence · current** First-quarter 2024 France Travail account compromise: Cap emploi network 6. **Occurred At · 100% confidence · current** CNIL proceeding SAN-2026-003 against France Travail: 2026-01-22 7. **Resulted In · 100% confidence · current** First-quarter 2024 France Travail account compromise: Social engineering was used to exploit trust or lack of awareness and take over Cap emploi adviser accounts; the source does not identify a more specific standardized technique. 8. **Resulted In · 100% confidence · current** First-quarter 2024 France Travail account compromise: The attackers hijacked Cap emploi adviser accounts and used them to access the France Travail information system in the first quarter of 2024. 9. **Exposed Data Category · 100% confidence · current** France Travail job-seeker data exposure: Contact information 10. **Disclosed At · 100% confidence · current** First-quarter 2024 France Travail account compromise: 2024-03-08 11. **Resulted In · 100% confidence · current** First-quarter 2024 France Travail account compromise: The CNIL found logging measures were inadequate for detecting abnormal behavior on the information system. 12. **Affected Individual Count · 90% confidence · current** France Travail job-seeker data exposure: 43,000,000 individual 13. **Resulted In · 100% confidence · current** First-quarter 2024 France Travail account compromise: France Travail job-seeker data exposure 14. **Resulted In · 100% confidence · current** First-quarter 2024 France Travail account compromise: The CNIL found the authentication procedures used by Cap emploi advisers to access France Travail were not sufficiently robust. 15. **Resulted In · 100% confidence · current** CNIL proceeding SAN-2026-003 against France Travail: The CNIL ordered France Travail to justify corrective measures on a specified schedule, with a €5,000 daily penalty for delay. 16. **Exposed Data Category · 100% confidence · current** France Travail job-seeker data exposure: Usernames and account identifiers 17. **Affected Organization · 100% confidence · current** First-quarter 2024 France Travail account compromise: France Travail 18. **Exposed Data Category · 100% confidence · current** France Travail job-seeker data exposure: Social Security numbers 19. **Resulted In · 100% confidence · current** First-quarter 2024 France Travail account compromise: CNIL proceeding SAN-2026-003 against France Travail 20. **Exposed Data Category · 100% confidence · current** France Travail job-seeker data exposure: Names