The biggest cyber attacks in France

France has had a run of breaches at a scale few countries can match. At France Travail, the data of up to 43 million people was exposed, more than half the population. All four of the country’s mobile operators, Orange, Bouygues, Free and SFR, have had customer data stolen within roughly eighteen months of each other.

This article covers eight documented cases, what was actually taken, and the pattern that connects the largest of them.

The biggest cyber attacks in France

1. France Travail (2024): 43 million people

Between 6 February and 5 March 2024, attackers were inside the systems of France Travail, the national employment agency formerly known as Pôle emploi, and of Cap emploi. The organisations notified the CNIL on 8 March. Exposed data included names, social security numbers, France Travail identifiers, email and postal addresses and phone numbers. No passwords or banking details were among the stolen records.

The 43 million figure covers everyone currently registered as a jobseeker, anyone who was registered over the previous twenty years, and anyone holding a candidate account on the website. The LockBit group is suspected. France Travail has since been targeted again, the third incident in under two years, with a later attack affecting around 340,000 jobseekers.

2. ANTS (2026): 11.7 million administrative accounts

The Agence nationale des titres sécurisés manages passports, national identity cards, driving licences and vehicle registration documents through ants.gouv.fr. In April 2026 the Ministry of the Interior confirmed that around 11.7 million accounts were affected, making it the largest administrative data leak publicly attributed to a French state service.

3. Bouygues Telecom (2025): 6.4 million accounts, including IBANs

In August 2025 Bouygues Telecom disclosed unauthorised access to personal data belonging to 6.4 million customer accounts. The exposed categories included contact details, contractual data, civil status information, company details for business customers, and IBAN bank account numbers.

The presence of IBANs is what makes this breach more dangerous than most. A bank account number combined with a real contract detail turns a generic scam message into something that reads like genuine correspondence.

4. Orange, Free and SFR: the rest of the sector

Orange suffered a cyber attack in July 2025 affecting millions of subscribers. Free Mobile was breached in late 2024, exposing data on 19 million subscribers and 5 million IBANs. SFR saw the data of 3.6 million customers published online after an attack in November 2024. Together with Bouygues, that is every major French mobile operator inside eighteen months.

5. La Poste, La Banque Postale and Mondial Relay

The postal service, its banking arm and parcel service Mondial Relay all appear among the most searched French breach incidents. For a postal and banking group the combination of address data and financial relationships is precisely what makes stolen records valuable: an attacker who knows both where you live and that you are expecting a parcel has everything needed for a convincing message.

6. Alinto (2026): 40 million email metadata records

A breach at email service provider Alinto exposed roughly 40 million email metadata records. The affected client list included L’Oréal, Renault, Carrefour and Hermès, all of which had outsourced email services to the provider. None of those brands was breached directly, which is exactly what makes this case worth studying.

7. French hospitals: where it gets physical

In the night of 20 to 21 August 2022, the Centre Hospitalier Sud Francilien in Corbeil-Essonnes was hit by ransomware. Newborns had to be transferred out of the neonatal unit. The attackers demanded 10 million dollars and, when it was not paid, published 11 gigabytes of stolen data.

The hospital of André-Mignot in Versailles followed in December 2022, the Simone Veil hospital in Cannes in January 2024, and the private hospital of the Loire in Saint-Étienne in July 2025, where the records of 126,000 patients were taken.

8. Schools and banks

French secondary schools and banks both appear consistently in breach searches. In education the target is usually the administrative platform holding pupil and parent data. In banking it is the customer relationship itself, because a leaked record there converts into an attempted transfer far faster than in any other sector.

The biggest cyber attacks in France at a glance

The eight cases above, side by side. Column seven is the one to read twice: in almost every case the way in was a person, a supplier or a reused password, not a zero-day.

What these attacks have in common

The data itself is rarely the point. France Travail lost social security numbers. Bouygues and Free lost IBANs. Alinto lost email metadata belonging to clients like Renault and Carrefour. None of that is directly monetisable. What it buys the attacker is credibility for the next step: a call, an email or an SMS containing details only a legitimate organisation should know.

The supplier is often the entrance. L’Oréal, Renault, Carrefour and Hermès were not breached. Their email provider was. If a third party holds your data, their security posture is now part of yours.

The consequences are not always financial. At Corbeil-Essonnes, newborns were moved out of neonatal care. That is what ransomware looks like when it lands on an organisation that cannot pause operations for a week.

These are not primarily technical failures. In most of these cases, someone was persuaded to do something: open a file, approve a login, share a credential. That is a human decision, and it works on the same principle as baiting: give a person a plausible reason to act, and the decision happens in seconds.

How to protect your organisation

• Assume the data is already out. With breaches at this scale, plan for the follow-up attack rather than only for prevention. Your staff will receive convincing messages built on real data.
• Check who else holds your records. The Alinto case shows that a provider’s breach becomes your incident, and your customers will not make the distinction.
• Practise, do not lecture. Realistic phishing simulations reveal which teams need support before an attacker does the test for you.
• Include the phone. Attackers increasingly call to get a multi-factor prompt approved. Training that only covers email leaves that door open.

For organisations under NIS2, awareness training is explicitly required rather than advisable. Our NIS2 guide sets out what the directive expects.