Threat watch / Breach
France Travail: data of 60,000 agents and professionals taken through one agent's account
CERT-FR says an attacker compromised a France Travail agent's account, passing its SMS second factor, and exfiltrated data on September 26, 2026. On October 8, the sale of data on more than 60,000 agents and professionals (names, work emails, phones, roles, agencies, internal identifiers) was claimed on a cybercriminal forum. The account was revoked and the malicious IP addresses blocked.
- Sector
- Government & politics
- Way in
- Stolen credentials
- Product or vendor
- None named
- agents and professionals whose data was claimed for sale, according to CERT-FR[1]
- 60K+
- How it happened
- "The compromise, with validation of the second factor (SMS), of an agent's account allowed the exfiltration of the data on September 26," CERT-FR says. It does not say how the account's password was obtained or how the SMS code was passed.[1] Checked 14 Nov 2026
- What was stolen
- Data on agents and professionals: names, work email addresses, phone numbers, roles, agencies and internal identifiers, according to CERT-FR.[1] Checked 14 Nov 2026
- Who was impacted
- More than 60,000 France Travail agents and professionals, according to the sale claimed on a cybercriminal forum and reported by CERT-FR. Jobseekers are not mentioned.[1] Checked 14 Nov 2026
- Threat actor
- Not attributed
Timeline
- Data is exfiltrated through a compromised agent account whose SMS second factor was validated, according to CERT-FR. [1]
- The sale of data on more than 60,000 agents and professionals is claimed on a cybercriminal forum. [1]
- CERT-FR's October REACTIV status report describes the incident: the account was revoked, the malicious IP addresses blocked, and investigations continue with ANSSI's support. [1]