Seller claims 450,000 Ircantec records, the pension fund for French public contract workers

The listing is just a few words long: “[FR] Ircantec 450K.” Posted on October 22 on a forum frequented by cybercriminals, it offers for sale a database presented as belonging to Ircantec. This fund manages the supplementary pension of non-tenured employees of the French state and local authorities. It is administered by the Caisse des Dépôts (a French public financial institution).

The seller goes by “fentag,” according to the FrenchBreaches site. They say they are acting as an intermediary on behalf of an acquaintance and list no price: buyers are invited to make an offer. At this stage, neither Ircantec nor the Caisse des Dépôts has confirmed an intrusion.

What would the file contain?

According to the listing, the file would contain last names, first names, phone numbers, email addresses and postal addresses. Fuites Infos analyzed a sample of 1,000 lines and also found dates of birth. In the material it examined, FrenchBreaches found no passwords, no Social Security numbers and no bank details.

Several clues nevertheless call for caution. The seller themself admits that some records are incomplete. According to Fuites Infos, nothing in the sample mentions Ircantec. Some of the lines correspond to organizations' addresses rather than individuals, and no date indicates when the data dates from. The figure of 450,000 people has not been verified by anyone. A number of lines claimed by a seller does not say how many people are actually affected.

A first alert in 2025

This is not Ircantec's first alert. In February 2025, the Caisse des Dépôts confirmed to AFP that an attacker had illegitimately accessed the personal data of some members, about 70,000 people including around a thousand local elected officials. The attacker had used the credentials of several public employers. According to Fuites Infos, nothing links that incident to the database now being offered for sale.

Files on public-sector employees attract data sellers. On October 11, France Travail (the French public employment agency) was already investigating a claimed leak of 62,848 employee records.

What to do if you are a member

Even without confirmation, caution is warranted. If the database is genuine, it could be used to send fraudulent messages in the name of your pension fund, with your real name and your real address.

• Be wary of emails, text messages and calls claiming to come from Ircantec or the Caisse des Dépôts, especially if they mention a pension file that needs to be regularized.
• Never give a password, a code received by text message or bank details to anyone you have not verified.
• To access your account, type the official site's address yourself rather than clicking a link you received.
• If someone impersonates you, file a complaint. The cybermalveillance.gouv.fr service (France's national cybercrime victim assistance platform) can support victims.

Everything now depends on the response from Ircantec and the Caisse des Dépôts: confirmation, denial or silence. In 2025, the Caisse informed the affected members. This time, it has not yet spoken publicly.