France Travail data breach exposes information of 340,000 jobseekers

France Travail, the French national public employment agency, has disclosed a new data breach that exposed personal information belonging to approximately 340,000 jobseekers. The breach, confirmed in a notification letter sent to affected individuals, marks the second major cybersecurity incident to impact the agency in just over a year.

According to France Travail, attackers accessed the data through the Kairos platform, a digital application used by training organizations and employment counselors to manage professional development programs and track jobseeker progress. The breach is believed to have occurred via unauthorized access to this partner-facing system.

The compromised data includes full names, postal addresses, email addresses, phone numbers, and internal France Travail ID numbers. Although no financial data was affected, authorities warn that the exposed information could be exploited for identity theft or targeted phishing scams. The French National Agency for the Security of Information Systems (ANSSI) has confirmed the method of access and is assisting with the investigation.

Cybersecurity experts say attackers could leverage the stolen information to create fraudulent job offers or lure victims into fake job interviews, potentially deploying malware to extract further personal or financial information. Similar techniques have been used in high-profile campaigns such as the Lazarus Group’s Operation DreamJob, where cybercriminals impersonated recruiters to trick individuals into installing malicious software.

France Travail has not observed signs of immediate misuse of the data but urges all affected individuals to remain vigilant and cautious of unsolicited communication, particularly messages promising employment opportunities or requesting sensitive information.

This incident follows a significantly larger breach at France Travail in March 2024, when attackers accessed personal information belonging to 43 million individuals, affecting more than two-thirds of France’s population. That breach, the largest in French history, led to the arrest of three suspects, all aged between 21 and 23, who allegedly impersonated Cap Emploi advisors to gain access to internal systems. The incident has not been linked to any known ransomware group or criminal organization.

The latest breach comes amid a broader uptick in cyberattacks targeting French institutions. Earlier this week, hackers claimed to have exfiltrated top-secret information from Naval Group, France’s largest shipbuilder. In May, the Stormous ransomware cartel also claimed to have leaked data from multiple high-profile French government organizations.