Data of 43 million people were stolen from France Travail (the French employment agency).

Error detected

The claim overstates the number of people affected by approximately 6.2 million (a difference of ~14.4%). The final verified figure by the CNIL is approximately 36.8 million, not 43 million.

The number of 43 million was an initial, unverified estimate of people 'potentially affected' — not a confirmed count of people whose data was definitively stolen.

Omissions

• The 43 million figure was the initial estimate announced by France Travail in March 2024, not the final verified number. The CNIL, in its sanction decision of 22 January 2026, revised the affected population down to approximately 36.8 million individuals.
• The claim states data were 'stolen' (dérobées), while official sources describe the incident as exposure or potential compromise of data — not necessarily exfiltration of all records for all individuals.
• The MEP made this claim on 17 June 2026, nearly five months after the CNIL published its final determination with the revised figure of 36.8 million. The speaker used the older, higher initial estimate rather than the authoritative final figure.
• France Travail was formerly known as Pôle Emploi (renamed in January 2024), and the breach also affected users of Cap Emploi, a related network for disabled job seekers.

Sources

• PrimaryCNIL (French Data Protection Authority)On 22 January 2026, the CNIL fined FRANCE TRAVAIL (formerly Pôle Emploi) €5 million for failing to ensure the security of job seekers' data. The breach exposed personal data including names, social security numbers, dates of birth, user IDs, email and postal addresses.
• SecondaryEuractivAt the time the breach was uncovered, France Travail said that 43 million people could be affected, later reducing the estimate to 36.8 million.
• SecondaryDataGuidanceCNIL fined France Travail €5 million for failing to secure personal data, affecting over 36.8 million individuals.
• SecondaryBleepingComputerIn March 2024, the French government agency disclosed that the attackers stole the sensitive data of up to 43 million individuals, including names, social security numbers, dates of birth, user IDs, email and postal addresses.