France Travail Hit by New Data Breach, 340,000 Jobseekers Potentially Affected

France Travail, the national employment agency, has announced yet another data breach, potentially exposing the personal information of approximately 340,000 jobseekers. This marks the third significant security incident for the agency in less than two years, raising serious concerns about the robustness of its cybersecurity infrastructure.

The breach, detected on July 13th and publicly disclosed on July 22nd, affected France Travail’s “employment portal,” a platform utilized by its partners, primarily training organizations. Initial investigations suggest the breach was facilitated by an infostealer malware that compromised a user account associated with a training organization in Isère. This allowed attackers to gain unauthorized access to Kairos, an application used to track jobseekers’ training progress.

Exposed data is believed to include names, postal and email addresses, phone numbers, France Travail identifiers, and jobseeker statuses. Crucially, the agency has stated that users’ passwords and bank details were not compromised in this incident.

Upon detection, France Travail immediately shut down the affected service and other related platforms as a precautionary measure. The agency has filed a complaint with French authorities and notified the CNIL (Commission Nationale de l’Informatique et des Libertés), the French data protection agency. Affected individuals are being informed directly via email. Services on the employment portal, including Kairos, are expected to be reactivated today, July 24th, following reinforced security measures.

This latest incident comes on the heels of a much larger breach in March 2024, which affected a staggering 43 million individuals, and another in August 2023, impacting around 10 million. The recurring nature of these breaches highlights persistent vulnerabilities within the agency’s systems.

While France Travail has moved to accelerate the rollout of two-factor authentication (2FA) for Kairos – a measure originally scheduled for October 2026 – the repeated compromises underscore the urgent need for a complete overhaul of its digital security protocols. Jobseekers are advised to remain highly vigilant against potential phishing attempts and other forms of social engineering that leverage the exposed personal information. The cumulative impact of these breaches on French citizens’ data privacy and security is a growing concern that demands immediate and effective government action.