[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuJQa_DbLUjUlrSrFbspl_jzfLgzR6NtsVO1GGejZ28g":3},{"article":4,"iocs":49},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":27,"category":28,"article_tags":31},"18c2b876-b34f-48c8-b52b-13cd3b05e089","Data breach: France Travail fined €5 million","data-breach-france-travail-fined-5-million-6b0df3","Data breach: France Travail fined €5 million ipayotfr Fri, 21\u002F08\u002F2026 - 10:25","France Travail has been fined €5 million by the CNIL for a data breach that occurred in early 2024. Hackers used social engineering to hijack accounts of CAP EMPLOI advisers, gaining access to personal data of individuals registered over the past 20 years. The CNIL found France Travail's technical and organizational security measures, including authentication and logging, to be inadequate, leading to the significant fine.","France Travail fined €5 million for data breach due to inadequate security measures.","Data breach: France Travail fined €5 million National News 02 February 2026 fr Background informationDate of final decision: 22 January 2026National caseController: FRANCE TRAVAILLegal Reference: Article 32 (Security of processing)Decision: Administrative fineKey words: Administrative fine, Data security, Data breachSummary of the DecisionOrigin of the caseIn the first quarter of 2024, one or more hackers managed to hack into the FRANCE TRAVAIL information system. They used techniques known as \"social engineering\", which involve exploiting people's trust, ignorance or credulity. This method enabled them to hijack the accounts of CAP EMPLOI advisers, i.e. the organisations responsible for supporting, monitoring and upholding the employment of people with disabilities.Investigations established that the hackers accessed the data of all individuals who were registered or who had been registered over the past 20 years, as well as individuals with a candidate account on francetravail.fr (including their National Insurance numbers, email and postal addresses, and telephone numbers). However, the hackers did not access the complete files of job seekers, which may include health data.The CNIL's investigation revealed that the technical and organisational measures implemented to ensure the security of the personal data processed were inadequate.Key FindingsBreach of the obligation to secure personal data (Article 32 of the GDPR) The restricted committee noted that FRANCE TRAVAIL had not implemented the technical and organisational measures that could have made the attack more difficult. As a reminder, the implementation of security measures appropriate to the risks is an obligation of means provided for in Article 32 of the GDPR.In particular, it noted that the authentication procedures allowing CAP EMPLOI advisers to access the FRANCE TRAVAIL information system were not sufficiently robust. In addition, the restricted committee highlighted the inadequacy of logging measures to detect abnormal behaviour on its information system. Finally, the restricted committee noted that CAP EMPLOI account access authorisations had been defined too broadly, allowing CAP EMPLOI advisers to access data on individuals they were not supporting, which increased the volume of data accessible to hackers. In determining the sanction, the restricted committee took into account the fact that most of the appropriate security measures had been identified by FRANCE TRAVAIL, prior to the implementation of the processing, in the impact assessments, but had not actually been implemented.DecisionAs a result, the restricted committee – the CNIL body responsible for imposing sanctions – imposed a fine of €5 million on FRANCE TRAVAIL, considering the ignorance of essential security principles, the number of people affected, and the volume and sensitivity of the data processed. In addition, the restricted committee ordered FRANCE TRAVAIL to justify the corrective measures taken, with a precise implementation schedule.Failing this, the organisation will have to pay a penalty of €5,000 per day of delay.For further information:[FR] : https:\u002F\u002Fwww.cnil.fr\u002Ffr\u002Fviolation-de-donnees-sanction-5millions-france-travail[EN] : https:\u002F\u002Fwww.cnil.fr\u002Fen\u002Fdata-breach-5million-fine-france-travail Relevant topics Personal data breaches Fines Latest news EDPB News Stakeholder event on guidelines on the interplay between data protection and competition law: express your interest30 July 2026 EDPB News Stakeholder event on guidelines on the interplay between data protection and competition law: save the date23 July 2026 EDPB News EDPB calls for legal basis for cross-regulatory information sharing17 July 2026All news","https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fdata-breach-france-travail-fined-eur5-million_en",null,"2026-08-21T08:25:10+00:00","2026-08-21T10:00:13.296179+00:00",8,[18,21,24],{"name":19,"type":20},"FRANCE TRAVAIL","vendor",{"name":22,"type":23},"CAP EMPLOI","product",{"name":25,"type":26},"social engineering","technology","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":27,"icon":13,"name":29,"slug":30},"Policy","policy",[32,37,42,44],{"category":33},{"id":34,"icon":13,"name":35,"slug":36},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":38},{"id":39,"icon":13,"name":40,"slug":41},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":43},{"id":27,"icon":13,"name":29,"slug":30},{"category":45},{"id":46,"icon":13,"name":47,"slug":48},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]