France Travail, the French national employment agency, disclosed in March 2024 that its systems and those of Cap Emploi — the service supporting jobseekers with disabilities — had been breached. The intrusion is reported as running from 6 February to 5 March 2024, with an estimated 43 million people potentially affected, covering registrations over the previous twenty years.
Reported fields include names, social security numbers, dates of birth, user identifiers, email and postal addresses and telephone numbers. The agency stated that complete jobseeker files and healthcare data were not accessed. Three people aged 21, 22 and 23 were arrested in France. The data protection regulator, the CNIL, subsequently fined France Travail €5 million over the security failings.
Twenty Years Is The Whole Finding
Forty-three million is most of the French adult population. It reaches that figure not because everyone was a customer but because everyone who was ever a customer was still on file.
We have recorded retention past the relationship at 23-1031, where a mortgage servicer held every former customer, at 22-0720 and at 22-0922. This is the public-sector version and the most difficult one: registering as unemployed is not a discretionary transaction a person can decline, and someone who found work in 2006 had no route to ask for their record to be removed.
The French Social Security Number Is Not A Reference
The NIR encodes sex, year and month of birth and place of birth within its structure. It is assigned at birth, used across health and welfare administration, and is not reissued.
The desk files unresettable identifiers at 26-0726, 22-0922 and 22-1111, where security answers were stored beside their questions. A national identifier that encodes biographical facts is the same category with a worse property: even suppressed, the number describes the person it was issued to.
The Regulator Fined The Victim
The CNIL penalty of €5 million was imposed on France Travail, the organisation that was attacked, for the security failings that permitted it.
We have recorded enforcement rarely and almost never against a public body. It is worth stating what the penalty does and does not do: five million euros across 43 million people is roughly twelve cents each, which is the arithmetic filed at 22-1020 and 25-1031, and the money moves from one part of the French state to another. What it produces is a published finding of fault, which is more than most files here contain.
Three People In Their Early Twenties
The arrests were of individuals aged 21, 22 and 23 — not a state programme and not an established criminal enterprise.
The corpus made the same observation at 22-0324, where those arrested over the Lapsus$ intrusions were between 16 and 21. The gap between the capability required and the consequence achieved keeps turning out to be enormous, and the industry’s vocabulary of sophistication keeps failing to describe it.
Compiled from the agency’s disclosure, contemporaneous reporting and subsequent reporting of the CNIL decision, listed below. The 43 million figure is described in reporting as a potential maximum rather than a confirmed count of affected records, and is carried on that basis. The description of the NIR’s structure is a matter of public record. No individual is named. Graded high. Corrections: corrections@forensicpost.com.
- French unemployment agency data breach impacts 43 million peopleBleepingComputer
- France Fines National Employment Agency €5m Over 2024 Data BreachInfosecurity Magazine
- 43 million workers potentially affected in France Travail data breachHelp Net Security