Data Breach at French Unemployment Agency May Span 20 Years, 43 Million Benefit Recipients

By Scott Ikeda for CPO Magazine
Tuesday, March 19, 2024

• 614
• More

A data breach at France’s national unemployment agency may have exposed 20 years worth of records, a possible total of 43 million between that and a related breach of an employment service for people with disabilities.

Dr Ilia Kolochenko, CEO at ImmuniWeb, expands on the risks that are created by a breach window that could have lasted up to a month: “What is quite alarming here, is the announced time frame of the disclosed intrusion, which has reportedly lasted from February 6 and March 5. Exfiltration of 43 million records is a quite “noisy” event that should have normally been detected much faster. While other technical details of the data breach remain unknown for the time being, it is perfectly conceivable that hackers could stealthily stay inside for the entire month, compromising and backdooring other internal systems with more sensitive data. Even if the currently disclosed scope of the data breach is eventually confirmed, the already compromised data can – and quite probably will – be exploited in spear phishing, account takeover and other cyberattacks against the concerned individuals. Moreover, cybercriminals can use the stolen data to blackmail the victims by asking for a ransom to avoid spreading information about their past unemployment history among colleagues causing embarrassment. In any case, victims shall stay vigilant for any incoming emails, calls and messages they receive later this year.”

As a nation, France is fresh off a record-setting data breach of two health care payment providers that exposed 33 million records. In terms of record count the unemployment agency breach is looking to now be the largest in the country’s history, seeing a record set and then broken within the space of about a month. Read Full Article