The IT Nerd

Wednesday, France Travail disclosed (Translation here) that hackers stole personal data belonging to 43 million job seekers who had registered with the French governmental unemployment agency. France Travail is the government agency in France tasked with registering unemployed citizens, offering financial assistance, and aiding them in securing employment opportunities.

The cyberattack occurred between February 6th and March 5th and includes data spanning 20 years. 

The data that has been exposed from this attack includes:

• Full name
• Date of birth
• Place of birth
• Social security number
• France Travail identifier
• Email address
• Postal address
• Phone number

This is the second data breach France Travail has suffered. Last August approximately 10 million individuals (Translation here) were impacted by an attack indirectly attributed to the Clop ransomware group who exploited a zero-day vulnerability in the MOVEit Transfer software tool.

The cyberattack on the agency sets a new record for France impacting the largest number of individuals, surpassing the more than the 33 million people (Translation here) impacted by the Viamedis and Almerys breach in February.

Ted Miracco, CEO, Approov Mobile Security:

   “The good news here is that while the disclosed information includes sensitive personal identifiers, it does not extend to passwords or banking information, limiting the scope of immediate financial fraud, however the potential for identity theft or other forms of cybercrime remains. Also, the response from France Travail aligns with best practices in handling data breaches, in compliance with the General Data Protection Regulation (GDPR). 

   “This incident underscores the critical need for organizations to implement robust cybersecurity measures at the edge, especially when it comes to mobile devices, which are increasingly used in attacks. Comprehensive security audits, regular vulnerability assessments, and real-time analytics are critical for security awareness. Lastly, it highlights the importance of having an incident response plan that can be quickly activated to mitigate the impact of data breaches.”

The fact that this organization has been pwned twice isn’t good. They really have some work to do to make sure that they don’t get pwned a third time.

The thing with cyberattacks is that they come in two parts. The first is that you get pwned. The second is that authorities often want to investigate you to see if you did or didn’t do something that led to the attack. Change Healthcare is into the second part after being pwned a few weeks ago. Here’s what HHS had to say:

Given the unprecedented magnitude of this cyberattack, and in the best interest of patients and health care providers, OCR is initiating an investigation into this incident. OCR’s investigation of Change Healthcare and UHG will focus on whether a breach of protected health information occurred and Change Healthcare’s and UHG’s compliance with the HIPAA Rules.

Ken Westin, Field CISO, Panther Labs had this to say:

I hope the investigation focuses on lessons learned and what both healthcare and government can do in partnership to both reduce the threat, as well as increase resilience to these types of attacks. If the goal of the investigation is to be punitive and seek fault to levy fines, I fear it would send the wrong message to the healthcare industry and will result in less collaboration and openness about these high impact security incidents. In my experience, healthcare IT and security departments are often underfunded and under resourced compared to other industries while at the same time dealing with unique challenges while having to navigate strict regulatory compliance frameworks. The best way to better secure the healthcare industry is through open dialogue and collaboration across the industry and with government resources. 

I for one will be interested to see what comes of this investigation given how much disruption that it has caused. I am sure that there will be other interested parties interested in the outcome as well. Having said that, I am sure that Change Healthcare and its parent UHG will find this investigation a couple steps below a proctology exam. Which is good because all the facts of this attack need to come out.