France Travail investigates claimed leak of 62,848 staff records

A new data leak targeting France Travail (the French public employment agency) has been claimed since October 7 on a cybercriminal forum. A hacker using the alias “0xRune” is selling a database of 62,848 records that reportedly concern the agency's staff, advisers and partners, not job seekers. France Travail has not confirmed the incident at this stage. It said it is carrying out “the necessary checks” and is following the situation closely.

The data involved

According to an analysis published by the monitoring site FrenchBreaches, based on a sample and the description of the file, and picked up by Génération NT, the database would contain:

• first and last names;
• work email addresses: of 999 addresses examined, 971 belong to the francetravail.fr domain, and the rest to partners such as Cap emploi;
• more than 100,000 landline and mobile phone numbers;
• job titles, work locations and internal identifiers.

No bank details or passwords appear in the material examined so far.

A compromised Microsoft account?

According to initial information, not officially confirmed, the attacker used an employee's work Microsoft account. The access was reportedly detected and blocked several days after the data was extracted. The investigation will have to determine whether the account was obtained through phishing or by other means.

If confirmed, this leak would add to a long series. According to Génération NT, it would be the fifth in less than three years for the public operator, including a 2024 leak that affected up to 43 million people.

Why it matters

Even without passwords, these files are valuable to scammers. Knowing an agent's name, job title, office and direct phone number makes it possible to build highly credible phishing attacks, or to impersonate a colleague, a manager or a partner to obtain access.

Best practices

• For agents and partners: be wary of emails, text messages or calls that mention colleagues or internal procedures, or that demand urgent action, and verify any unusual request through a known channel.
• Enable and strengthen multifactor authentication on work accounts, preferably with a phishing-resistant method.
• Report any suspicious contact to the IT security team.
• For organizations: monitor for abnormal sign-ins to Microsoft 365 accounts and limit individual accounts' access to full directories.