Massive Data Leak Exposes Over 1 Million French Employment Records
Hackers operating under the aliases misere and ChimeraZ claim to have stolen more than 1 million sensitive records from France Travail’s employment-related applications, including HR, mobility, and workplace health systems. The breach, linked to platforms AKAOLIFE and FILDIRECT-RH, involves nearly 60GB of data across 39 databases and over 10,000 source files.
The leaked data includes:
- 966,816 HR files and 1,003,047 professional mobility records
- 38,138 workplace health monitoring files and 3,747 disability-related documents
- 26,684 accounts with plaintext passwords, alongside application code, security keys, and Windows login credentials
Exposed details extend beyond basic contact information, revealing French social security numbers, employee IDs, job histories, internal mobility requests, and recruiter comments enough to craft highly convincing phishing scams. The breach also raises concerns about further system exploitation due to exposed configuration files.
Both hackers have been active in recent incidents: ChimeraZ was linked to a breach at optical retailer Krys, while misere was tied to a leak of 650,000 messages from France’s Tchap secure messaging platform. The primary risk for affected workers is impersonation, with attackers potentially posing as HR, recruiters, or public service officials to extract sensitive documents or credentials. The inclusion of plaintext passwords compounds the threat, particularly for those who reuse passwords across services.
Source: https://www.techrepublic.com/article/news-akaolife-data-claim-emea-france/
AKAOLIFE TPRM report: https://www.rankiteo.com/company/akaolife
Tchap TPRM report: https://www.rankiteo.com/company/la-suite-gouv
France Travail TPRM report: https://www.rankiteo.com/company/france-travail
"id": "la-fraaka1782507245",
"linkid": "la-suite-gouv, france-travail, akaolife",
"type": "Breach",
"date": "6/2026",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Over 1 million individuals',
'industry': 'Employment Services',
'location': 'France',
'name': 'France Travail',
'type': 'Government/Employment Agency'}],
'data_breach': {'data_encryption': 'No (plaintext passwords exposed)',
'data_exfiltration': 'Yes',
'number_of_records_exposed': 'Over 1 million records (966,816 '
'HR files, 1,003,047 mobility '
'records, 38,138 health files, '
'3,747 disability documents, '
'26,684 accounts with plaintext '
'passwords)',
'personally_identifiable_information': 'Yes (French social '
'security numbers, '
'employee IDs, job '
'histories, etc.)',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['HR files',
'professional mobility records',
'workplace health monitoring '
'files',
'disability-related documents',
'plaintext passwords',
'application code',
'security keys',
'Windows login credentials',
'French social security numbers',
'employee IDs',
'job histories',
'internal mobility requests',
'recruiter comments']},
'description': 'Hackers operating under the aliases *misere* and *ChimeraZ* '
'claim to have stolen more than 1 million sensitive records '
'from France Travail’s employment-related applications, '
'including HR, mobility, and workplace health systems. The '
'breach involves nearly 60GB of data across 39 databases and '
'over 10,000 source files. Exposed details include French '
'social security numbers, employee IDs, job histories, '
'internal mobility requests, recruiter comments, plaintext '
'passwords, application code, security keys, and Windows login '
'credentials. The primary risk is impersonation for phishing '
'scams.',
'impact': {'brand_reputation_impact': 'High',
'data_compromised': '60GB of data across 39 databases and over '
'10,000 source files',
'identity_theft_risk': 'High',
'systems_affected': ['HR systems',
'mobility systems',
'workplace health systems']},
'motivation': 'Data Exfiltration',
'threat_actor': ['misere', 'ChimeraZ'],
'title': 'Massive Data Leak Exposes Over 1 Million French Employment Records',
'type': 'Data Breach'}