French Employment Agency Announces Data Breach Exposes Personal Information of 10 Million Individuals
- Written by Shipra Sanganeria Cybersecurity & Tech Writer
French governmental agency Pôle employ, on August 23rd, disclosed a data breach incident that is likely to affect around 10 million people registered with it.
The unemployment registration and financial aid provider stated that it became aware of the breach, a week before the announcement. One of its vendors, the Majorel company, responsible for documentation and registration of job seekers was impacted by the MOVEit campaign of Cl0p ransomware gang.
The campaign did not directly compromise the security of the agency’s internal IT system but the attack on the third-party’s system led to the data exposure of millions of job seekers. The agency did not confirm the number of affected individuals. However, French daily Le Parisien estimates the impacted individual number to be around 10 million.
According to the agency, the compromised data belongs to the people who had registered with it by the end of February 2022. The exposed data includes first and last name as well as social security number of individuals. Sensitive information like email addresses, phone numbers, password or bank details were not a part of the data leak.
Although the risk of phishing and other forms of cybercrimes is limited here, Pôle employ still advised the affected individuals to remain vigilant in the face of any type of communication that could appear fraudulent.
The agency has filed a report with the French data privacy agency CNIL and is also said to report to the concerned judicial authority. It has also set up a dedicated phone support for the impacted individuals and will also be implementing additional security measures to prevent occurrence of similar incidents in the future.
It further went on to state that its financial aid program continues to remain unaffected, and individuals can securely log onto their accounts using the ‘’pole-emploi.fr’’ portal.
Millions of Duolingo Users’ Data Available for Sale on Hacking Forum
- Written by Shipra Sanganeria Cybersecurity & Tech Writer
Duolingo, a popular language learning app saw around 2.6 million users’ scrapped data leaked on a hacking forum. The compromised data included a user’s email address, phone numbers, real and login names, as well as information related to availed Duolingo services.
The app which boasts of more than 74 million users, stated in January this year that it was investigating the leak, when samples of user information was posted on the now defunct hacking forum, Breached for $1,500.
According to the company’s initial statement, the attackers have not breached its systems, rather the information was obtained from public sources. Nevertheless, the availability of leaked email addresses is concerning as it exposes the compromised individuals to phishing and social engineering attacks.
‘’No data breach or hack has occurred. We take data privacy and security seriously and are continuing to investigate this matter to determine if there’s any further action needed to protect our learners,” the company’s spokesperson stated.
First spotted and revealed by VX-Underground on social platform X, the leaked dataset was available for sale on the new version of the Breached hacking forum for as little as $2.13.
Using an exposed application programming interface (API) which was first identified in March 2023, the attackers had managed to obtain the information. By exploiting the API, an attacker only needs to feed in the target’s email address or username to obtain the JSON file containing public information matching with the submitted usernames.
Although the abuse of this API was reported by Duolingo and other cybersecurity researchers earlier this year, it still continues to be freely available on the web.
According to security researchers, scrapped data containing public information is not too dangerous. However, when mixed with private, sensitive information, the data can be a potent weapon in the hands of threat actors, especially when carrying out phishing attacks.
