Article
CISO’s Guide to Account Takeover Prevention: Detection, Response, and Recovery
Account Takeover explained for CISOs: the attack chain, detection signals, incident response steps and hardening that closes the gap after an ATO event.
Read more
Significant cyber incident
France Travail data breach, 2024
In the first quarter of 2024, attackers used social engineering to take over accounts of Cap emploi advisers and reach the France Travail job seeker database.
In short
In the first quarter of 2024, attackers used social engineering to take over accounts of Cap emploi advisers and reach the France Travail job seeker database. France Travail said in March 2024 that data of potentially 43 million people had been exfiltrated, covering names, social security numbers and contact details. On 22 January 2026 the French data regulator CNIL fined France Travail 5 million euros for weak security.
What happened
On 13 March 2024 France Travail, the French public employment operator, and the Cap emploi network said they had been hit by a cyber attack. Job seekers’ personal data had been extracted. France Travail said the database held data of people registered now, people registered in the last 20 years, and people with a candidate space on its website. It said potentially 43 million people were affected.
The exposed data was name, birth date, social security number, France Travail ID, email and postal addresses and phone numbers. France Travail said passwords and bank details were not affected and benefit payments were not at risk. The CNIL later said the attackers did not reach complete job seeker files, which can include health data.
France Travail told the data regulator CNIL and filed a complaint. The Paris public prosecutor opened a preliminary investigation. No public attribution of the attack appears in the sources opened.
On 22 January 2026 the CNIL fined France Travail 5 million euros under Article 32 of the GDPR. It published the decision on 29 January 2026.
Timeline
-
1 January 2024
France Travail replaces Pôle emploi.
-
First quarter 2024
Attackers use social engineering to hijack Cap emploi adviser accounts and reach the France Travail system (CNIL).
-
8 March 2024
France Travail and Cap emploi inform the CNIL of the intrusion (CNIL, 13 March 2024).
-
13 March 2024
France Travail and Cap emploi announce the attack, say data of potentially 43 million people was exfiltrated, notify the CNIL and file a complaint.
-
13 March 2024
The Paris public prosecutor has opened a preliminary investigation, led by the Paris judicial police cybercrime unit.
-
22 January 2026
The CNIL's restricted committee fines France Travail 5 million euros (deliberation SAN-2026-003).
-
29 January 2026
The CNIL publishes the sanction and its reasons.
How the attack worked
Step 1: tricking advisers
The CNIL says the attackers used social engineering, which means exploiting people’s trust, ignorance or credulity. This let them take over accounts of Cap emploi advisers. Cap emploi organizations support people with disabilities and had access to the France Travail system.
Step 2: weak sign-in and wide access
The CNIL found that the sign-in method for Cap emploi advisers was not robust enough. It also found that account permissions were too broad. Advisers could see data of people they did not support, so a single stolen account exposed far more data.
Step 3: no early warning
The CNIL found that logging was not enough to detect abnormal behavior. The attackers could therefore reach data of everyone registered in the past 20 years and extract it.
The sources opened do not give MITRE ATT&CK technique numbers, tools or the exact method of the social engineering, so none are listed.
Who says who was behind it
No public attribution appears in the sources opened. The CNIL says "one or more hackers" took part. France Travail called the attack an act of cyber malevolence and the Paris prosecutor opened a preliminary investigation (France Travail, 13 March 2024).
Impact
Data exposed: France Travail said on 13 March 2024 that potentially 43 million people were affected. The CNIL's sanction decision later put the number of people whose data was compromised at 36,820,828 (Légifrance, SAN-2026-003). It says the attackers accessed data of everyone registered in the past 20 years and people with a candidate account.
Data types: name, birth date, social security number, France Travail ID, email and postal addresses and phone numbers (France Travail). Passwords and bank details were not affected, and complete job seeker files, which can include health data, were not accessed (France Travail, CNIL).
Risk: France Travail advised people to watch for phishing and identity theft.
Penalty: 5 million euros and an order to show corrective measures, with 5,000 euros per day of delay otherwise (CNIL, 22 January 2026).
Government and regulator response
- 13 March 2024: France Travail notified the CNIL, filed a complaint and told people to watch for phishing. It took extra steps with Cap emploi to protect partner access. The Paris public prosecutor opened a preliminary investigation.
- 22 January 2026: the CNIL fined France Travail 5 million euros for failing to secure personal data (Article 32 GDPR) and ordered it to show corrective measures on a schedule.
- 29 January 2026: the CNIL published the decision. It noted that fines go to the State budget.
- A member of the National Assembly asked the labour minister about accountability after the fine (written question 17362).
Lessons
-
Partner accounts are your accounts
Attackers reached the system through Cap emploi adviser accounts. Treat partner and supplier users with the same sign-in rules as staff.
-
Least privilege limits damage
Adviser permissions were too broad, so each account could reach people it did not support (CNIL). Limit access to the people a user serves.
-
Log for abnormal use
The CNIL found logging was not enough to detect abnormal behavior. Alert on bulk reads and unusual searches.
-
Known fixes must be done
Most suitable measures were in the impact assessments but not implemented (CNIL). A risk assessment only helps if its actions are carried out.
-
Public bodies are fined too
The CNIL applies the same range up to 10 million euros to a public operator. The fine goes to the State budget.
-
Tell people early and clearly
France Travail named the data types, said what was not affected and gave phishing advice on the day it announced the attack.
What to check in your own organization
-
Partner access
List every external organization with accounts on your systems and check sign-in strength for each.
-
Multi-factor sign-in
Require a second factor for advisers, partners and staff who can read personal data.
-
Permission scope
Review whether users can see records of people or customers they do not handle, and narrow it.
-
Bulk access alerts
Add alerts for large searches, exports and unusual hours for accounts that normally read single records.
-
Log coverage
Confirm you log reads, not only logins, on systems that hold personal data, and that someone reviews them.
-
Assessment follow-up
Compare the actions in your last risk or impact assessment with what is actually in place.
-
Staff awareness
Train staff and partners to spot calls and mails that try to obtain access credentials.
Where it happened
- Country France France faces espionage by state-linked groups, data theft and ransomware, and attacks around big events such as the Paris 2024 Games. Europe
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
Questions
What happened at France Travail?
Attackers used social engineering to take over Cap emploi adviser accounts in the first quarter of 2024 and reached job seeker data. France Travail announced it on 13 March 2024.
How many people were affected?
France Travail said potentially 43 million people had data exfiltrated. The CNIL's January 2026 decision puts the number of people concerned at 36,820,828, including people registered over the past 20 years and holders of a website account.
What data was taken?
Name, birth date, social security number, France Travail ID, email and postal addresses and phone numbers. Passwords and bank details were not affected, according to France Travail.
What did the CNIL decide?
On 22 January 2026 it fined France Travail 5 million euros for weak authentication, weak logging and overly broad permissions, and ordered corrective measures.
Who was behind it?
No public attribution appears in the sources opened.
What should affected people do?
France Travail advised people to be very careful about phishing emails and calls and identity theft attempts, and never to share passwords or bank details.
In our research
Sources
- Data breach: FRANCE TRAVAIL fined 5 million euros CNIL
- Violation de données : sanction de 5 millions d'euros à l'encontre de FRANCE TRAVAIL CNIL
- France Travail et Cap emploi victimes d'une cyberattaque (press release, 13 March 2024) France Travail
- Cybersécurité - fuite France Travail (written question 17362) National Assembly of France
- Data breach: FRANCE TRAVAIL fined €5 million CNIL
- Clôture de l'injonction prononcée à l'encontre de FRANCE TRAVAIL CNIL
- Délibération SAN-2026-003 du 22 janvier 2026 (sanction against FRANCE TRAVAIL) Légifrance (CNIL)
- France Travail : la CNIL enquête sur la fuite de données et donne des conseils pour se protéger (13 March 2024) CNIL
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.