Urssaf Data Breach Exposes Employment Data of 12 Million French Workers

The Urssaf has revealed that the employment data of 12 million employees hired over the past three years was accessed illegally through a partner account whose credentials had been compromised in a previous cyberattack. The breach involved an interface containing names, birth dates, employer Siret numbers, and hiring dates, but sensitive information such as social security numbers, email addresses, phone numbers, and bank details were not affected.

Following detection of this unauthorized access, Urssaf swiftly suspended the compromised partner account and filed a complaint with the public prosecutor. This incident follows a mid-November data theft affecting the Pajemploi service, which manages declarations and payments for childminders and home caregivers, potentially impacting up to 1.2 million employees.

The agency has issued warnings about heightened phishing risks due to the breach and urged vigilance among those potentially affected. The data breach raises concerns as it could be exploited for fraudulent schemes targeting a vast number of French workers. Urssaf’s transparency and rapid response reflect the seriousness of the situation and efforts to contain the fallout.

This breach underscores the vulnerability of important employment data despite protective measures and highlights the ongoing cyber threat landscape in France's social security and employment sectors.