France fines employment agency €5 million for exposing data of 43M people

The French data protection authority (CNIL) has imposed a €5 million fine on France Travail for failing to adequately secure the personal data of job seekers, following a cyberattack that exposed sensitive information belonging to roughly 43 million individuals.

The CNIL concluded that France Travail, formerly Pôle Emploi, violated Article 32 of the General Data Protection Regulation (GDPR), which mandates data controllers to implement appropriate technical and organizational safeguards. The breach, which occurred in Q1 2024, involved attackers exploiting weak internal controls through social engineering to gain unauthorized access to France Travail’s systems.

According to the investigation, the attackers infiltrated user accounts belonging to counselors from CAP EMPLOI, specialized employment services for people with disabilities, by manipulating them into revealing access credentials. Once inside the system, the intruders accessed a vast dataset that included names, social security numbers, email and postal addresses, and phone numbers of all individuals who had been registered with the agency in the past two decades or had created a candidate account on francetravail.fr.

France Travail is a major public administrative body under the French government, responsible for connecting job seekers with employment opportunities and distributing unemployment benefits. Its operations are largely financed through employer and employee social contributions, and, as a public entity, it is not subject to GDPR penalties tied to annual turnover. Instead, the law caps such fines at €10 million for public institutions.

The CNIL’s restricted committee, responsible for determining sanctions, cited several key failures by France Travail:

• Weak authentication protocols for CAP EMPLOI counselors, which failed to meet standard security expectations.
• Inadequate access controls, which allowed employees to access the data of individuals they were not directly assisting.
• Insufficient logging and monitoring, which hindered the detection of abnormal account behavior.

Notably, the CNIL pointed out that France Travail had already identified many of these shortcomings in earlier data protection impact assessments but failed to address them in practice.

While the breach did not include sensitive data such as health information or bank details, the volume and nature of the exposed data were significant enough to pose severe risks of identity theft, phishing, and fraud. CNIL’s ruling emphasized that basic security hygiene, such as role-based access, proper logging, and two-factor authentication, could have significantly mitigated the attack.

In addition to the fine, CNIL has issued a formal compliance order requiring France Travail to implement specific corrective measures by a defined deadline. Failure to meet this timeline could result in further penalties, including a daily fine of €5,000.

The €5 million sanction is one of the largest CNIL has issued to a public body. The incident remains the largest data breach in France’s public sector history.

For affected individuals, CNIL recommends vigilance against social engineering attempts, especially unsolicited communications requesting personal information. While CNIL does not offer direct compensation, individuals may file criminal complaints with law enforcement to support ongoing investigations or pursue civil claims.