France Travail 2024: 43M French Citizens Leaked, What Really Happened

> TL;DR: Technical breakdown of the France Travail data breach in 2024: how 43 million records were exposed, timeline, and lessons learned.

Timeline

February 2024: France Travail (formerly Pole Emploi, the French national employment agency) discovers unauthorized access to its database. The agency notifies CNIL (France's data protection authority) on March 8, 2024.

March 13, 2024: France Travail publishes a statement acknowledging a cyberattack that potentially exposed personal data of 43 million people. The scope includes current job seekers, former registrants over the past 20 years, and anyone with a candidate account.

March 2024: CNIL opens an investigation. The Paris prosecutor's office refers the case to its cybercrime section.

Data Exposed

Compromised data includes names, dates of birth, social security numbers, France Travail identifiers, email and postal addresses, and phone numbers. Passwords and banking data were not affected according to France Travail.

The social security number is the critical element. It is a unique, permanent identifier. Unlike a password, it cannot be changed. It is used as an authentication key in many contexts (healthcare, retirement, government services).

Attack Vector

Based on public information, the attack exploited compromised Cap Emploi counselor accounts. Attackers used these legitimate credentials to query the database and extract information. This was not a spectacular technical vulnerability, but a failure of access control and monitoring.

Critical points identified:

Impact

43 million people affected, covering virtually the entire active and formerly active French population. The exposed data enables targeted phishing (spear phishing), identity theft, and administrative fraud.

CNIL received thousands of reports following the incident. Phishing campaigns exploiting the stolen data were detected in the following weeks.

Lessons for Organizations

Access control is not optional. Accounts with global access to a database of 43 million records represent systemic risk. Least privilege would have limited extraction.

Mass extraction detection is essential. If an account downloads millions of records, the system must alert immediately.

Historical data must be archived. Keeping 20 years of data accessible online multiplies the impact surface.

Authentication for critical access must be strengthened. Multi-factor authentication for accounts with access to sensitive data is not a luxury.

What CleanIssue Checks

During a external review, we identify exactly this type of flaw: overly broad access, APIs without extraction limits, exposed historical data. This is what makes the difference between a limited incident and a 43-million-victim catastrophe.

The France Travail breach underscores a pattern seen repeatedly in public-sector systems: legacy architectures, broad internal access, and insufficient monitoring create conditions where a single compromised credential can expose decades of accumulated personal data.

Key Takeaways