FRFrance Travail data breach
France Travail (francetravail.fr) suffered a data breach on 5 March 2024. Here is what leaked, how to find out whether you are affected, and what to do.
Indicative guide: high if passwords, bank details, ID documents or health data leaked; medium if a phone number, address or date of birth; low otherwise.
- Breach date
- 5 March 2024
- People affected
- 36,800,000
- Types of data
- 7
- Made public on
- 13 March 2024
What leaked
Are you affected?
This breach is not on Have I Been Pwned. According to the CNIL, it affects people registered as jobseekers at the time of the attack or during the previous 20 years, as well as people who had a candidate account on francetravail.fr.
Have you been registered with Pôle emploi or France Travail since 2004? Assume that you are affected.
What happened
Between 6 February and 5 March 2024, attackers impersonated advisers from Cap emploi, the network that supports people with disabilities, to get into the France Travail information system. The public employment service announced it on 13 March 2024.
The figure announced at the time, 43 million people, was later reduced to 36.8 million after removing duplicates.
According to the CNIL, the leaked data are: last and first name, social security number, France Travail ID, email and postal addresses, phone number. France Travail also mentioned date of birth. Neither passwords nor bank details are concerned.
The CNIL’s fine
On 22 January 2026, the CNIL fined France Travail €5 million for failing to ensure the security of the data (Article 32 GDPR). For a public body, the ceiling is €10 million. It also ordered it to fix its weaknesses, with a penalty of €5,000 per day of delay. France Travail did not challenge the fine.
On 23 September 2026, the CNIL closed this order: France Travail had brought itself into compliance in time.
The concrete risks
The social security number sets this breach apart: it cannot be changed. Together with your name and address, it makes fake messages from the Assurance maladie (health insurance), the CAF (family benefits) or France Travail credible (“update your file”, “refund pending”) and can be used to steal your identity.
A message asking for your login details or your bank details (RIB) to “update your file” is suspicious: log in by typing francetravail.fr or ameli.fr yourself. Watch your statements, and file a complaint if a loan or contract is opened in your name.
Which letter should you send to France Travail?
Send an access request (Article 15): you will find out what France Travail holds about you and what leaked. It has one month to reply.
Erasure is limited: France Travail is a public service, and Article 17(3) GDPR allows it to refuse to erase what the law requires it to keep or what serves its mission. You can still request it for an old candidate account or data that are no longer used: it will have to reply and give reasons for any refusal.
What to do now?
Your action plan
0 / 5 doneYour progress stays in this browser.
A message that mentions the breach, a call “from your bank”? See what to do on What to do?.
Write to France Travail
The GDPR lets you ask the company what data it holds about you and what leaked (Articles 15 and 34), or to erase your data (Article 17). It has one month to reply (Article 12(3)).
Ask what leakedRequest erasure
The contact of the data protection officer (DPO) is usually in the privacy policy of francetravail.fr. The letters are indicative templates, not legal advice.
Frequently asked questions
How many people are affected by the France Travail breach?
36.8 million people, after removing duplicates. The first figure announced in March 2024 was 43 million.
Did my social security number leak?
Yes, if it was in your file: the CNIL lists it among the data concerned. It cannot be changed, which is why you should be wary of fake messages from the Assurance maladie.
Can I get my data erased by France Travail?
Not all of it: a public service may refuse to erase what the law requires it to keep (Article 17(3) GDPR). Start with an access request (Article 15).
Sources
- CNIL, March 2024 (in French) (new tab)
- Blog du Modérateur, March 2024 (in French) (new tab)
- Siècle Digital, 29 January 2026 (in French) (new tab)
- France Travail, press release of 29 January 2026 (in French) (new tab)
- LexisVeille, closure of the order (September 2026, in French) (new tab)
Information gathered on 13 October 2026.
This breach is not in the Have I Been Pwned catalogue: the information comes from the sources above. This is public information about the breach, not the breached data. Logos provided by Have I Been Pwned. Trademarks belong to their owners; ShredRGPD has no connection with these companies.