French government agency fined nearly $6 million for data security failings

France’s data protection authority (CNIL) fined France Travail €5 million after social engineering attacks in early 2024 allowed adversaries to compromise accounts and access 20 years of registrant personal data (National Insurance numbers, email/postal addresses, telephone numbers); no health data was accessed. CNIL cited failures including weak authentication, insufficient logging to detect abnormal behavior, and excessive data access, and ordered remediation and implementation of proper security controls.