French national employment agency Pôle Emploi faces cyberattack impacting millions

The French national employment agency, Pôle emploi, has become the target of a cyber-attack, potentially jeopardizing critical information of nearly 10 million individuals.Several security researchers have linked the breach to the notorious Clop ransomware gang’s MOVEit campaign, which impacted 977 organizations and almost 59 million individuals.

Eminent anti-virus software company Emsisoft has taken a stand on the attack, identifying it as an integral part of the MOVEit campaign and estimating that Pôle emploi ranks as the second-largest victim ensnared in this supply chain assault. The breach, experts speculate, has potentially exposed the personal data of approximately six million individuals who registered with the agency in February 2022, along with an additional four million who had been off the agency’s records for less than a year at the time of the cyber onslaught.

A formal statement released by Pôle emploi on August 23, 2023, confirmed the breach and acknowledged the "risk of disclosure of jobseekers’ data." The breach was specifically traced to the IT systems of Majorel, one of the agency’s contracted service providers responsible for digitization and data processing related to jobseekers. Notably, this breach marks the second time the MOVEit hack has exploited vulnerabilities through Majorel, following similar incidents involving the German insurer Barmer and Deutsche Bank.

However, despite the breach, Pôle emploi assured the public that the security of its information system remains uncompromised and welfare payments will continue to be processed without disruption. The agency clarified that the breach has no bearing on jobseekers’ email addresses, phone numbers, passwords, or bank details, thus alleviating certain concerns regarding the extent of the data breach.

In light of these developments, Clément Domingo, a respected French security researcher, noted on Twitter that there is currently no evidence of any leaked data samples on the dark web, suggesting that the full scale of the breach’s consequences is still unfolding.

Internal investigations are underway at Pôle emploi’s premises to ascertain the origins and methods of the cyber-attack. The agency has taken swift action by filing a comprehensive report with France’s data protection watchdog, CNIL, and has announced its intention to lodge an official complaint with judicial authorities.