France Travail, the French employment agency, experienced a data breach affecting 340,000 users. Personal data, including names, addresses, phone numbers, and jobseeker statuses, were exposed. The breach was caused by an infostealer malware compromising a user account linked to a training organization. The agency assured that passwords and bank details were not affected but warned users about phishing risks. This is the second breach in two years for France Travail.
Source: https://www.infosecurity-magazine.com/news/france-data-breach-jobseekers/
TPRM report: https://scoringcyber.rankiteo.com/company/francetravail
"id": "fra242072325",
"linkid": "francetravail",
"type": "Breach",
"date": "7/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 340000,
'industry': 'Employment Services',
'location': 'France',
'name': 'France Travail',
'type': 'Employment Agency'}],
'attack_vector': 'Infostealer Malware',
'customer_advisories': 'Email notification to users, public statement',
'data_breach': {'number_of_records_exposed': 340000,
'personally_identifiable_information': True,
'sensitivity_of_data': 'Personal data',
'type_of_data_compromised': 'Names, postal and email '
'addresses, phone numbers, France '
'Travail identifiers, jobseeker '
'statuses'},
'date_detected': '2023-07-13',
'date_publicly_disclosed': '2023-07-22',
'description': 'The French employment agency, France Travail, has suffered a '
'data breach that could affect hundreds of thousands of '
'jobseekers. The agency sent an email to its users on July 22, '
'warning them of a data breach that was detected on July 13 on '
"its 'employment' portal, which is used by its partners.",
'impact': {'data_compromised': 'Personal data of 340,000 users including '
'names, postal and email addresses, phone '
'numbers, France Travail identifiers, and '
'jobseeker statuses',
'downtime': 'Services shut down on July 12, expected to be '
'reactivated on July 24',
'systems_affected': ['Kairos', 'Employment portal']},
'initial_access_broker': {'entry_point': 'User account compromise via '
'infostealer malware'},
'post_incident_analysis': {'corrective_actions': 'Strengthened security '
'measures, accelerated '
'rollout of 2FA',
'root_causes': 'User account compromise via '
'infostealer malware'},
'references': [{'source': 'Next'}],
'regulatory_compliance': {'legal_actions': 'Complaint filed with French '
'authorities, notified CNIL',
'regulatory_notifications': 'Notified CNIL'},
'response': {'communication_strategy': 'Notified affected individuals, public '
'statement',
'containment_measures': 'Services shut down',
'law_enforcement_notified': True,
'recovery_measures': 'Services expected to be reactivated on '
'July 24',
'remediation_measures': 'Strengthened security measures, '
'accelerated rollout of 2FA'},
'title': 'France Travail Data Breach',
'type': 'Data Breach',
'vulnerability_exploited': 'User account compromise'}