On 22 January 2026, the CNIL’s restricted committee handed down its decision: a 5 million euro fine against France Travail, together with an injunction backed by a penalty of 5,000 euros per day of delay (deliberation SAN-2026-003, published 29 January 2026). Almost two years after the largest personal data breach in French history, 43 million records downloaded, 36,820,828 people affected after deduplication, the regulator’s verdict is in: the attack succeeded not because of the attackers’ brilliance, but because of elementary security failures.
The first installment of our “Attack autopsies” series, this article reconstructs the case end to end from primary sources only: the CNIL decision, the Paris prosecutor’s statement, CERT-FR publications and Senate proceedings. Every fact is dated and attributed, because official statements get taken down, but the lessons need to outlive them.
The case in six points
- The scale: the attackers downloaded a database “estimated at 43 million personal data records” (Paris prosecutor’s statement, 19 March 2024); after deduplication, the CNIL finds 25 GB exfiltrated concerning 36,820,828 people (deliberation SAN-2026-003 of 22 January 2026). It is the largest data breach ever recorded in France.
- The vector: no software vulnerability. “Social engineering” techniques were used to take over Cap Emploi adviser accounts through password-reset requests made to the IT support provider (CNIL decision); searches confirmed that some suspects were engaged in fraud “using the phishing technique” (prosecutor, 19 March 2024).
- The timeline: accounts used from 6 February to 5 March 2024 (prosecutor); abnormal activity detected on 29 February, the alert acknowledged on 4 March in the evening, investigations on 5 March (CNIL decision, para. 10); CNIL notified on 8 March 2024.
- The sanction: 5 million euros for breaching Article 32 of the GDPR, plus a compliance injunction backed by a 5,000 euros/day penalty beyond one month: deliberation SAN-2026-003 of 22 January 2026, published 29 January 2026 and to be anonymized after 29 January 2028.
- The arrests: three suspects arrested on 17 March 2024 by the BL2C, brought before an investigating judge on 19 March with a view to indictment for fraudulent access to an automated data processing system, data extraction, fraud and money laundering as an organized gang (Paris prosecutor). They are presumed innocent.
- The lesson: the three families of failures sanctioned (weak authentication with no MFA and a lockout at 50 attempts, unmonitored logging, unrestricted access rights) are baseline controls within reach of any SME.
The case in numbers
36.8M
people affected after deduplication
CNIL, SAN-2026-003
25 GB
of data exfiltrated
CNIL, SAN-2026-003, para. 13
€5M
GDPR fine (Article 32)
CNIL, 22 January 2026
28
days of fraudulent access
Paris prosecutor, 19 March 2024
Timeline
Timeline
How events unfolded
2022
The risk identified... and deferred
France Travail's own impact assessment (DPIA) flags the risk: "if an external attacker hacks the workstation of a Cap Emploi adviser it will be easy for him to access the data" (our translation). MFA, planned for 2023, is postponed to April 2024.
Source · CNIL decision SAN-2026-003
6 February 2024
First fraudulent access
First access via hijacked Cap Emploi adviser accounts; 9 GB of data extracted that same day.
Source · CNIL decision SAN-2026-003 (para. 86); Paris prosecutor, 19/03/2024
6 February to 5 March 2024
A month of exfiltration
The hijacked accounts "had been used to download data from the jobseeker database estimated at 43 million personal data records" (our translation).
Source · Paris prosecutor, statement of 19/03/2024
29 February 2024
The ignored signal
"Abnormal activity was detected on the performance-monitoring system", causing "partial unavailability of the service and heavy resource consumption" (our translation).
Source · CNIL decision SAN-2026-003 (para. 10)
4 March 2024
The alert finally acknowledged
"The alert was noted and acted upon at the end of the day on Monday 4 March 2024" (our translation).
Source · CNIL decision SAN-2026-003 (para. 10)
5 March 2024
End of malicious activity
Internal investigations; end of the malicious-activity window established by the courts.
Source · CNIL decision (para. 10); prosecutor, 19/03/2024
8 March 2024
CNIL notified
France Travail notifies the data breach to the CNIL.
Source · CNIL decision (para. 15); prosecutor, 19/03/2024
12 March 2024
BL2C takes the case
The Paris prosecutor's office, once informed, assigns the investigation to the BL2C (Paris judicial police cybercrime brigade).
Source · Paris prosecutor, 19/03/2024
13 March 2024
Public announcement
Public disclosure. The CNIL confirms up to "43 million users" potentially affected, announces its inspections and publishes protective advice. Cybermalveillance.gouv.fr puts a complaint-letter form online.
Source · CNIL, 13/03/2024; Cybermalveillance.gouv.fr, 13/03/2024
17 March 2024
Three arrests
"Three people were arrested on Sunday 17 March 2024" (born November 2001, September 2000 and September 2002).
Source · Paris prosecutor, 19/03/2024
19 March 2024
Judicial investigation opened
The suspects are brought before an investigating judge with a view to indictment; a judicial investigation is opened for fraudulent access to and presence in an automated data processing system, data extraction, fraud and money laundering, "each of these offences aggravated by commission as an organized gang" (our translation).
Source · Paris prosecutor, 19/03/2024
21 March 2024
CNIL on-site inspection
On-site CNIL inspection at France Travail's premises.
Source · CNIL decision SAN-2026-003
15 May 2024
Notification completed
Notification to the CNIL supplemented.
Source · CNIL decision SAN-2026-003 (para. 15)
18 September 2024
The CERT-FR retex
CERT-FR publishes its anonymized lessons-learned report on social-sector data exfiltrations (CERTFR-2024-CTI-009).
Source · CERT-FR, 18/09/2024
11 March 2025
The Panorama names France Travail
The 2024 Cyber Threat Overview names the incident "that hit France Travail" and links it to the 2024 lessons-learned report.
Source · CERT-FR, CERTFR-2025-CTI-003, 11/03/2025
June 2025
The ShinyHunters lead (press)
The press reports the arrest of suspects linked to the ShinyHunters group, "suspected" of attacks targeting France Travail among others, an attribution not judicially confirmed.
Source · Press, June 2025
26 June 2025
The Senate steps in
Written question no. 05318 by Senator Arnaud Bazin on the protection of French citizens' data, citing the France Travail breach.
Source · French Senate, official journal of 26/06/2025
22 January 2026
A 5-million-euro fine
Deliberation SAN-2026-003: 5 million euro fine and injunction backed by a 5,000 euros/day penalty, for breach of Article 32 GDPR.
Source · CNIL / Légifrance
29 January 2026
Sanction published
The sanction is published. The decision "will no longer identify FRANCE TRAVAIL by name" after 29 January 2028 (our translation).
Source · CNIL, 29/01/2026
5 May 2026
Toward an inquiry committee
Draft resolution no. 595 (Nathalie Goulet and 37 co-signatories) to create a parliamentary commission of inquiry into cyberattacks and data leaks, explicitly citing the France Travail hack.
Source · French Senate, PPR no. 595 (2025-2026)
The attack chain: a phone call, no exploit
What the CNIL established
Attack chain
How the intrusion unfolded
Defensive reconstruction: every link you understand is a link you can break.
Preparatory collection
The attackers gather the information needed for password-reset requests on Cap Emploi adviser accounts (CNIL decision).
Social engineering of the support desk
Password-reset requests impersonating advisers are sent to the IT support provider (CNIL decision, para. 11-12).
Account takeover
The usurped adviser accounts open access to the professional portal and the jobseeker database.
Mass queries
High-volume queries, outside business hours, with a 69% error rate, harvest the database (CNIL decision, para. 86).
Exfiltration
25 GB of data concerning 36,820,828 people are exfiltrated between 6 February and 5 March 2024 (CNIL decision, para. 13).
Late detection
The abnormal activity of 29 February is only acknowledged on the evening of 4 March: logging existed, nobody was watching it (CNIL decision, para. 10).
Decision SAN-2026-003 is unambiguous: “The attack was carried out using so-called ‘social engineering’ techniques, that is, techniques consisting of obtaining goods or information by exploiting the trust, ignorance or credulity of third parties” (para. 12, our translation of « L’attaque a été menée par des techniques dites “d’ingénierie sociale”, c’est-à-dire selon des techniques consistant à obtenir un bien ou une information, en exploitant la confiance, l’ignorance ou la crédulité de tierces personnes »).
Concretely, according to the facts established by the restricted committee, the attackers:
- Gathered the data needed to reset the passwords of adviser accounts at Cap Emploi, France Travail’s partner organization supporting jobseekers with disabilities;
- Contacted the IT support provider while impersonating Cap Emploi employees to obtain those resets, and thereby took over the accounts;
- Called advisers while posing as IT support (the same lie run in the other direction) to obtain credentials.
The way in was the human password-reset workflow, with no malware and no software vulnerability.
Once they held the accounts, exfiltration ran through the business application used to look up jobseeker files, with superficially legitimate queries: the decision notes “the considerable volume of data extracted”: 25 GB in total, including 9 GB on 6 February 2024 alone; a 69% error rate on one of the compromised accounts, and access outside normal working hours (para. 86). None of these signals triggered an alert for a month.
What the courts established
The statement by the Paris public prosecutor, Laure Beccuau, dated 19 March 2024, defines the scope: “between 6 February and 5 March, Cap Emploi agent accounts, authorized to access resources on France Travail’s information system, had been used to download data from the jobseeker database estimated at 43 million personal data records” (our translation).
And it adds a detail the CNIL does not: “The searches carried out at their homes and on their computer equipment confirmed, for some of them, a fraud activity using the ‘phishing’ technique” (our translation). The profile that emerges is not that of a state-sponsored group: it is a small crew versed in phishing and fraud, which found in a poorly protected partner account a doorway to a database covering half the country.
What CERT-FR documented
CERT-FR (the incident response team of ANSSI, France’s national cybersecurity agency) published an anonymized lessons-learned report on social-sector data exfiltrations on 18 September 2024 (CERTFR-2024-CTI-009). Its generic finding matches the France Travail scenario exactly: “the attackers used legitimate access, obtained via successful phishing campaigns or on credential-resale sites. Using these accounts, legitimate database queries allowed them to exfiltrate the contents, in the absence of any rules or limits” (our translation of « les attaquants ont utilisé des accès légitimes, récupérés via des campagnes d’hameçonnage réussies ou sur des sites de revente d’identifiants de connexion »).
Without naming the victim, the report cites one case in which “external provider accounts — without strong authentication — were compromised and used to exfiltrate an entire database”, and another in which an attacker, “by simulating millions of searches”, was able “through simple browsing, to extract the contents” of a data-consultation platform (our translations).
The link to France Travail was made official on 11 March 2025: the 2024 Cyber Threat Overview (CERTFR-2025-CTI-003) explicitly names, among the most significant social-sector incidents, the one “that hit France Travail, resulting in the exfiltration of large quantities of personal data belonging to many French citizens” (our translation), referring back to the 2024 lessons-learned report.
The ShinyHunters attribution: a press lead, not an established fact
In June 2025, the specialist press reported the arrest in France of several suspects linked to the ShinyHunters cybercrime group and the BreachForums platform, “suspected” of attacks targeting Boulanger, SFR, the French Football Federation, and France Travail. As of this article’s last update, that link remains journalistic attribution: neither the CNIL decision nor public judicial statements formally connect the February 2024 breach to this group. The individuals under investigation, in that case as in the March 2024 one, are presumed innocent.
For context, one final note: France Travail (then still Pole emploi) had already been hit in August 2023, through a service provider, by the MOVEit exploitation campaign attributed to the Cl0p group, around 10 million jobseekers affected, according to press reports at the time.
The compromised data
The prosecutor’s statement of 19 March 2024 lists precisely what the downloaded database contained: “last name, first name, date and place of birth, physical address, email address, phone number, NIR (social security number), France Travail identifiers” (our translation).
The CNIL confirmed as early as 13 March 2024 that “passwords and bank details are not affected” (our translation).
The critical item remains the NIR, the French social security number: unlike a password, it cannot be changed. Combined with a name, date of birth and address, it enables long-lasting administrative identity theft and phishing, vishing and smishing campaigns of formidable credibility: the attacker knows real facts about the target. That risk does not expire: data stolen in 2024 will fuel scams for years.
The failures sanctioned by the CNIL
The restricted committee assessed the security arrangements against Article 32 of the GDPR and concluded, at paragraph 99 of its decision: “the restricted committee considers that FRANCE TRAVAIL breached its obligations under Article 32 of the GDPR” (our translation). Three families of failures were retained, and each one is a B2B lesson.
1. Threadbare authentication on ultra-sensitive accounts
Cap Emploi adviser accounts gave access to jobseeker files with a simple username-and-password pair. The password policy in force tolerated up to 50 failed login attempts before locking the account, where the CNIL recommends locking at around 10.
Above all, the absence of multi-factor authentication was not a blind spot: it was a risk documented internally. The data protection impact assessment (DPIA) carried out in 2022 warned: “if an external attacker hacks the workstation of a Cap Emploi adviser it will be easy for him to access the data” (our translation). MFA, planned for 2023, had been postponed to April 2024; the attack came in February. The decision states that multi-factor authentication would have made the account takeover “extremely difficult”, and notes that “FRANCE TRAVAIL reports having implemented multi-factor authentication after the data breach” (para. 75, our translation). Identifying the right control protects nothing; deploying it does.
2. Logging with nobody watching
France Travail did log access, but did not use its logs: the decision points to the absence of regular, automated log review and of any real-time alerting. The result: 9 GB extracted in a single day on 6 February, a 69% error rate on one account, connections outside business hours, and no reaction until the sheer volume degraded system performance on 29 February. A log nobody reads is an alibi, not a security measure.
3. Access rights without limits
Cap Emploi advisers (whose organizations operate at the departmental level) could look up jobseeker files from all over France: the decision notes that “they can, on their own initiative, modify the scope of the search without geographic limitation” (para. 94, our translation). One compromised account in one department therefore opened the national database. It is the antithesis of the principle of least privilege.
What the CNIL did not retain
An important precision for reading this decision correctly: the sanction rests solely on Article 32 (security). The restricted committee found no breach of the notification obligation (Article 33) or the duty to inform individuals (Article 34), and data retention periods are not among the sanctioned grievances. The regulator’s message is crystal clear: it was prevention that failed, not the response.
The response and the legal deadlines
Notifying the CNIL: 72 hours, but starting when?
The timeline established in the decision (para. 10) deserves quoting in full: “On Thursday 29 February 2024, abnormal activity was detected on the performance-monitoring system of FRANCE TRAVAIL’s information system, causing partial unavailability of the service and heavy resource consumption. The alert was noted and acted upon at the end of the day on Monday 4 March 2024, and then gave rise to investigations on Tuesday 5 March 2024” (our translation).
Notification to the CNIL came on 8 March 2024, supplemented on 15 May 2024 (para. 15), within 72 hours of the incident being qualified on 5 March, in line with Article 33 of the GDPR, under which the clock starts upon becoming aware of the breach. The CNIL raised no grievance on this point. But the line “Thursday’s alert acknowledged at the end of the day on Monday” tells another story: four days between the signal and its handling. Alert-handling delay is something you can measure and improve: that is exactly what a tested incident response plan is for (see our guide on what to do during a phishing attack).
Informing the affected individuals
France Travail communicated publicly on 13 March 2024, the day the CNIL published its own statement confirming up to “43 million users” potentially affected, announcing inspections to verify “whether the security measures complied with the GDPR”, and issuing its vigilance advice: never share passwords or bank details by message, check account activity regularly, reach official sites directly rather than by clicking links. Individual notification of the people affected followed.
The complaint-letter scheme: unprecedented at this scale
From 13 March 2024, Cybermalveillance.gouv.fr put online a complaint-letter form allowing victims to file a complaint without visiting a police station, via the Démarches-simplifiées.fr portal, while warning of the risks of “phishing, attempted fraud or identity theft” (our translation). Designed to absorb tens of millions of potential complainants, the scheme has since become the template response to French mega-breaches.
The political aftermath
The case has left a lasting mark on public debate. On 26 June 2025, Senator Arnaud Bazin questioned the government (written question no. 05318) on the protection of French citizens’ data, citing the France Travail breach among the precedents. On 5 May 2026, Senator Nathalie Goulet and 37 co-signatories tabled draft resolution no. 595 to create a parliamentary commission of inquiry into cyberattacks and data leaks undermining France’s digital sovereignty, with the France Travail hack and its 43 million records explicitly cited as a founding event.
Lessons from France Travail for a small business
Every one of the sanctioned failures has a direct equivalent in a company of 20 or 200 people. Here are the five controls to check this week.
1. MFA on every account, especially partner accounts
The broken link was not an internal France Travail account: it was an account belonging to a partner organization. Your service providers, accounting firms, managed IT providers and franchisees with access to your systems are your attack surface. The CNIL held that MFA would have made the attack “extremely difficult”: deploy it everywhere, starting with external access.
2. Lock down the password-reset workflow
The attackers did not crack any password: they politely asked the helpdesk to reset it. Impose a non-negotiable identity verification procedure on your helpdesk (in-house or outsourced): a callback to a known number, manager validation, never a reset on a mere inbound call. It costs nothing, and it would have been enough to stop this attack.
3. Watch for bulk exports
Nine gigabytes extracted in one day without an alert. Define alert thresholds on the volume of queries and exports against your customer data, and make sure a human receives and handles those alerts. CERT-FR explicitly recommends restricting bulk data exports with tighter rules and alerting business owners to any suspicious behavior. A log with no alerting and no review has never stopped anyone.
4. Least privilege for external access
A departmental adviser could query the national database. Ask the question for every third-party access: does this partner need to see all my data, or only their own scope? Restrict by default, widen on justification.
5. Train your teams against social engineering, helpdesk included
This attack succeeded because humans (at the support desk, among the advisers) trusted convincing strangers. The human factor is involved in 62% of data breaches (Verizon DBIR 2026; see our phishing statistics for France). Awareness training is no longer optional: it is an explicit NIS2 requirement for in-scope entities (our NIS2 guide for SMEs covers who is concerned), and phishing and vishing simulations remain the only way to measure your team’s real-world exposure. Round it out with a free test of your email security: misconfigured SPF, DKIM and DMARC make it easier to spoof your domain in exactly this kind of scenario.
Verdict
The France Travail case will go down in history for three reasons. Its scale: 36.8 million people, an absolute French record. Its technical banality: a password-reset workflow and an overly trusting IT helpdesk, with no exploit and no malware. And its precedent value: with SAN-2026-003, the CNIL fined France Travail 5 million euros not for being attacked, but for the gap between the risks France Travail had itself identified back in 2022 and the measures actually deployed by February 2024.
That is the lesson to frame on the wall: in security, a risk assessment without implementation is evidence for the prosecution. MFA, reset procedures, export monitoring, least privilege, training: none of these controls is advanced cybersecurity. They are the bare minimum, and they are now the standard against which the regulator will judge your organization.
Find this incident and over 100 others in our French cyberattack database.
FAQ
What sanction did the CNIL impose on France Travail? A 5 million euro administrative fine for breaching Article 32 of the GDPR, together with a compliance injunction backed by a penalty of 5,000 euros per day of delay after a one-month deadline (deliberation SAN-2026-003 of 22 January 2026, published 29 January 2026).
How did the attackers get in? Through social engineering: password resets on Cap Emploi adviser accounts obtained from the IT support provider by impersonating employees, according to the CNIL decision. Searches confirmed that some suspects were engaged in fraud “using the phishing technique” (Paris prosecutor, 19 March 2024).
Am I affected, and what should I do? Potentially, if you were registered with France Travail or supported by Cap Emploi in the 20 years before February 2024 (36.8 million people). Maximum vigilance toward messages quoting your real data, never share your social security number or bank details with an inbound caller, monitor your accounts, and file a complaint via the Cybermalveillance.gouv.fr form.
43 or 36.8 million victims? 43 million: the initial estimate of the downloaded database (prosecutor, 19 March 2024). 36,820,828: the deduplicated count established by the CNIL decision.
Was the 72-hour deadline met? Yes, within the meaning of Article 33: investigations on 5 March 2024, notification on 8 March. The CNIL found no breach regarding notification or informing individuals, only regarding security (Article 32).
Who hacked France Travail? Three suspects arrested on 17 March 2024 and brought before a judge with a view to indictment, presumed innocent. The ShinyHunters attribution floated by the press in June 2025 has not been judicially confirmed for this breach.
Sources:
- CNIL, “Violation de données : sanction de 5 millions d’euros à l’encontre de France Travail”, 29 January 2026: cnil.fr (accessed 05/09/2026)
- CNIL, restricted committee deliberation no. SAN-2026-003 of 22 January 2026: legifrance.gouv.fr (accessed 05/09/2026; the decision will be anonymized after 29/01/2028: it “will no longer identify FRANCE TRAVAIL by name upon expiry of a two-year period from its publication”)
- CNIL, “France Travail : la CNIL enquête sur la fuite de données et donne des conseils pour se protéger”, 13 March 2024: cnil.fr (accessed 05/09/2026)
- Paris judicial court prosecutor’s office, press statement by the public prosecutor, 19 March 2024: tribunal-de-paris.justice.fr (PDF); reproduction and analysis: Next, 20/03/2024 (accessed 05/09/2026)
- CERT-FR (ANSSI), “Exfiltration de données du secteur social : retour d’expérience du CERT-FR”, CERTFR-2024-CTI-009, 18 September 2024: cert.ssi.gouv.fr (accessed 05/09/2026)
- CERT-FR (ANSSI), “Panorama de la cybermenace 2024”, CERTFR-2025-CTI-003, 11 March 2025: cert.ssi.gouv.fr (accessed 05/09/2026)
- Cybermalveillance.gouv.fr, “Violation de données personnelles France Travail : formulaire de lettre-plainte”, 13 March 2024: cybermalveillance.gouv.fr (accessed 05/09/2026)
- French Senate, written question no. 05318 by Senator Arnaud Bazin, official journal of 26 June 2025: senat.fr (accessed 05/09/2026)
- French Senate, draft resolution no. 595 (2025-2026) to create a commission of inquiry into cyberattacks and data leaks, tabled 5 May 2026: senat.fr (accessed 05/09/2026)
- Verizon, Data Breach Investigations Report 2026: verizon.com (accessed 05/09/2026)
Note: CNIL press releases are generally taken offline after roughly two years, and decision SAN-2026-003 will be anonymized after 29 January 2028. The dated quotes in this article stand as a record of their content as of the access date.
Exhibits
The case exhibits
CNIL22 January 2026
Exhibit 01
“Social engineering techniques, which exploit the trust, ignorance or credulity of third parties, were used to take over Cap Emploi adviser accounts. (our translation)”
Paris public prosecutor19 March 2024
Exhibit 02
“The usurped accounts had been used to download data from the jobseeker database, estimated at 43 million personal data records. (our translation)”
CNIL22 January 2026
Exhibit 03
“Abnormal activity was detected on the performance-monitoring system… The alert was noted and acted upon on Monday 4 March 2024 at the end of the day. (our translation)”
CERT-FR (ANSSI)18 September 2024
Exhibit 04
“Successful phishing campaigns or credential-resale marketplaces are at the origin of the compromise of external provider accounts. (our translation)”