France Travail Data Breach: What Millions of Workers Need to Know

A massive data leak impacting the French employment ecosystem has exposed the personal and professional records of millions of individuals. According to reports, hackers using the aliases “misere” and “ChimeraZ” claim to have accessed 14.4 million lines of data, including sensitive information tied to the France Travail ecosystem. The breach involves roughly 60GB of database backups across 39 databases, raising significant concerns regarding identity theft and targeted phishing attacks.

What information was exposed in the leak?

The leaked data reportedly spans a wide range of administrative and personal records. Analysis by the security research group FrenchBreaches indicates that the files originate from applications linked to AKAOLIFE and FILDIRECT-RH. The exposed datasets include:

• HR and Professional Data: Approximately 966,816 HR files and over 1 million professional mobility records.
• Personal Identifiers: Names, birth dates, home addresses, personal email addresses, phone numbers, and French social security numbers.
• Workplace Health and Disability: Over 38,000 workplace health monitoring files and 3,747 records related to disability status.
• Credentials: 26,684 user accounts containing passwords allegedly stored in plain text.
• System Information: Application source code, website security keys, Windows login data, and configuration files.

How are hackers using this data?

The primary risk to affected individuals is impersonation. By leveraging detailed job histories, recruitment comments, and mobility requests, attackers can craft highly credible phishing emails or phone calls. These attempts may appear to originate from legitimate HR departments, public service offices, or workplace health providers.

The presence of plaintext passwords presents an immediate security vulnerability. If these credentials were reused on other platforms, those secondary accounts are now at risk of unauthorized access. Users should change passwords across any services where the same credentials may have been used and implement multi-factor authentication (MFA).

Who is behind the attack?

The aliases “misere” and “ChimeraZ” have been active in recent cyberattack reports. ChimeraZ was linked to an alleged leak involving the optical retailer Krys. Meanwhile, the alias “misere” was associated with a separate incident involving France’s Tchap, which reportedly exposed 650,000 messages and 73,000 accounts.

How should affected workers protect themselves?

If you are an employee in France or a user of these employment services, you should treat any unsolicited communication—even those appearing to come from official channels—with extreme caution. Do not provide login credentials, identity documents, or financial information in response to unexpected messages regarding your employment or disability records. Always verify the request through an official channel before taking action.

Key Takeaways for Data Security

• Verify Official Channels: If you receive a request for sensitive data, contact your HR department or the public service agency directly.
• Update Credentials: Change your passwords immediately, especially if you have ever used your work-related credentials on other websites or applications.
• Enable MFA: Protect your accounts by enabling multi-factor authentication.
• Monitor for Phishing: Be wary of emails or texts that reference specific details from your work history.