Cybersecurity Settlement in France: €5M France Travail Fine, NIS2

France’s data protection authority, the CNIL, fined France Travail €5 million on January 22, 2026, over the security failures that allowed hackers to steal the personal data of roughly 43 million current and former job seekers in early 2024. The penalty was issued under Article 32 of the GDPR, which requires security measures proportionate to the risks of processing personal data, and it came with an order to fix the underlying problems or pay €5,000 for every day of delay.¹

What the Breach Exposed

France Travail, the national employment agency formerly known as Pôle Emploi, disclosed in March 2024 that attackers had been inside its systems and those of Cap Emploi, a service for people with disabilities, from February 6 to March 5, 2024. The compromised records covered two decades of registrations.²

The data stolen included names, social security numbers, dates of birth, user IDs, email and postal addresses, and phone numbers. Complete job seeker files, which can contain health information, were not accessed. The attackers got in by using social engineering to hijack the login credentials of Cap Emploi advisers, who had access to the broader France Travail information system.¹

Why the CNIL Fined France Travail

The CNIL identified four specific security failings behind the intrusion:

Authentication for Cap Emploi advisers logging into the France Travail system was not strong enough to resist account compromise.
The agency had inadequate logging and monitoring tools, so suspicious activity on the network went undetected.
Access rights were far too broad: Cap Emploi advisers could view records of people they were not assisting.
France Travail’s own data protection impact assessments had identified the measures needed to prevent exactly this kind of attack, but the agency never put them in place.

That last point drove much of the regulator’s reasoning. The agency knew what to do and had written it down; it simply did not act.¹

How the €5 Million Figure Was Set

Because France Travail is a publicly funded body with a fixed budget, the CNIL did not calculate the fine as a percentage of revenue, which is the usual approach for private companies under the GDPR. Instead, it worked within the statutory range for security violations. The agency also faces a €5,000-per-day penalty for any delay in demonstrating that the required corrective measures have been implemented on the regulator’s timeline.²³

A Second Breach Before the Fine Landed

The CNIL’s penalty was not the end of France Travail’s security problems. In July 2025, attackers used infostealer malware to compromise a user account belonging to a training organization in Isère, then pivoted into Kairos, a platform partner organizations use to track job seeker training. Around 340,000 people had their names, addresses, email addresses, phone numbers, and France Travail identifiers exposed. Passwords and bank details were not affected.⁴

The agency shut down the portal and partner services, filed a complaint, notified the CNIL, and brought forward the rollout of two-factor authentication on Kairos, which had been scheduled for October 2026. No separate fine has been reported for the 2025 incident.⁴

Part of a Much Larger Enforcement Wave

The France Travail penalty sits inside a dramatic escalation in CNIL enforcement. In 2025, the regulator issued 83 sanctions totaling nearly €487 million, about eight times the €55 million it imposed across 87 sanctions in 2024.⁵

Several of the headline cases turned on the same kinds of security and consent failures:

Google LLC and Google Ireland were fined a combined €325 million in September 2025 over advertisements disguised as emails in Gmail’s Promotions and Social tabs, and a cookie consent process during account creation that made it harder to refuse personalized advertising trackers than to accept them.⁶
Free Mobile and Free received €27 million and €15 million fines in January 2026 after an October 2024 breach affecting 24 million subscriber contracts. The CNIL cited weak VPN authentication, ineffective behavior detection, and breach notifications that failed to tell affected people what to do.⁷
Health data analytics firm IQVIA was fined €5 million in May 2026 for mishandling pseudonymized records from pharmacies and doctors. The CNIL found the data was not truly anonymous because IQVIA held the keys needed to re-identify patients, so the full GDPR applied. Violations included a lack of multi-factor authentication, failure to analyze connection logs, and a design flaw that transmitted patient data even when patients had refused.⁸
Nexpublica France was fined €1.7 million in December 2025 for weaknesses in PCRM software used by public disability support services. Users could view sensitive documents belonging to other individuals, including information revealing disabilities, and the CNIL found the company had ignored its own audit reports identifying the problems.⁹

The common thread across these cases is unmistakable: known risks that organizations documented and failed to mitigate.

The NIS2 Rules That Would Have Applied

While the CNIL has been enforcing existing law hard, France has yet to adopt the next layer of EU cybersecurity rules. The NIS2 Directive, passed in 2022 to strengthen protections for critical infrastructure, had to be transposed into national law by October 2024. France missed that deadline.¹⁰

The European Commission sent a formal letter in November 2024 and a reasoned opinion in May 2025, and expects to refer France to the Court of Justice of the EU around mid-2026. A separate referral regarding the Critical Entities Resilience (CER) Directive was filed in April 2026.¹⁰¹¹

France combined NIS2 and CER transposition into a single “Resilience” bill. The Senate adopted it in March 2025, and a National Assembly committee completed its review in September 2025 after adopting 245 amendments, including bringing software publishers into scope, reintegrating metropolitan authorities as “essential entities,” and excluding nuclear security activities. Final adoption is expected later in 2026.¹²¹³

In the meantime, the French National Cybersecurity Agency (ANSSI) published the ReCyF (Référentiel Cyber France) on March 17, 2026. It is a voluntary technical framework built around 20 security objectives that maps to what the Resilience bill is expected to require. Organizations already following ISO 27001 and similar standards can use a comparison tool to identify overlaps. The framework is nonbinding until the legislation is finalized.¹⁴¹⁵

On January 29, 2026, the same week the France Travail fine was widely reported, the French government published a 2026–2030 national cybersecurity strategy through the SGDSN. The strategy points to stricter and more prescriptive security requirements for critical infrastructure in the coming years, along with more assertive state-led attribution of attacks and closer alignment with EU-level sanctions.¹⁶

The 72-Hour Criminal Complaint Rule

Any business or professional operating in France that suffers a cyberattack has, since April 24, 2023, been required to file a formal criminal complaint with police or prosecutors within 72 hours of discovering the breach. Failing to do so forfeits the right to insurance reimbursement for the resulting losses, regardless of what the policy itself says. The requirement is codified in Article L.12-10-1 of the French Insurance Code and, as a matter of public policy, cannot be waived by contract.¹⁷

The rule reaches well beyond personal data incidents. It covers ransomware, unauthorized access, data theft, and system disruption. In practice, organizations often cannot determine the full scope of an incident within 72 hours, so precautionary complaints have become common.¹⁸

Civil Recourse for Affected Individuals

France overhauled its class action regime with Law No. 2025-391 of April 30, 2025, replacing earlier fragmented legislation and transposing the EU Representative Actions Directive. Approved associations and consumer groups can now bring opt-in class actions across all areas of law, including data protection. Two data-related actions are pending: one by Internet Society France against Facebook, and another by UFC-Que Choisir against Google, alleging that Google’s privacy rules are so opaque users cannot meaningfully control how their data is used. Punitive damages remain unavailable under French law, so any compensation is limited to actual losses.¹⁹

1
CNIL. Data Breach: 5 Million Fine France Travail
2
Infosecurity Magazine. France Fines Employment Agency 5M
3
Help Net Security. France Travail 5 Million EUR Fine
4
Infosecurity Magazine. France Data Breach Jobseekers
5
CMS Law. GDPR Enforcement Tracker Report: France
6
CNIL. Cookies and Advertisements Inserted Between Emails: Google Fined 325 Million Euros
7
CNIL. Sanction: Free
8
CNIL. Health Data: Fine of 5 Million Euros Against IQVIA
9
CNIL. Data Security: Nexpublica France Fined EUR 1,700,000
10
Politico. EU Take France Spain Court Cyber Law Delay
11
Critical Entities Resilience Directive. Transposition: France
12
InCyber. Transposition of NIS2: National Assembly Committee Completes Review
13
Eversheds Sutherland. EU NIS2 Directive: France
14
ANSSI. The NIS 2 Directive
15
Numeum. NIS2 Directive: Understanding the New European Cybersecurity Framework and Its Impact on Businesses in France
16
MLex. France Shares Five-Year National Cybersecurity Strategy
17
CMS Law. Cyber Space: Global Insights on Cyber and Data Risk for Insurers
18
DataProtection Report. Cyber Insurance: 72 Hours for the Insured Party to File a Criminal Complaint
19
ICLG. Class and Group Actions Laws and Regulations: France