# FRANCE TRAVAIL: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: French Data Protection Authority (CNIL)
- Date: 2026-01-22
- Original: https://www.enforcementtracker.com/ETid-3026
- Canonical: https://overview.legal/posts/52380
- Topics: Security, Healthcare, Health Data, Controllers, Public Sector, Personal Data, Education, Public Authority, Processing Agreement, Supervisory Authorities

## Summary

The French DPA has imposed a fine of EUR 5,000,000 on FRANCE TRAVAIL. The controller suffered a successful cyber attack due to insufficient technical and organisational measures, resulting in the leak of personal and special category data concerning 38,820,828 individuals. The attack was carried out using the 'social engineering' method, meaning that the attacker obtained goods or information by exploiting the trust, ignorance or credulity of third parties.

## Full text

The French DPA has imposed a fine of EUR 5,000,000 on FRANCE TRAVAIL. The controller suffered a successful cyber attack due to insufficient technical and organisational measures, resulting in the leak of personal and special category data concerning 38,820,828 individuals. The attack was carried out using the 'social engineering' method, meaning that the attacker obtained goods or information by exploiting the trust, ignorance or credulity of third parties.

GDPR Articles: Art. 32 GDPR
Industry: Public Sector and Education

---
Generated by overview.legal · https://overview.legal/posts/52380 · 2026-08-22