www.francetravail.fr
Attack Intelligence
www.francetravail.fr was compromised in a ransomware attack attributed to stormous in October 2025. The organization, operating in an undisclosed sector in France, was added to the group's data leak site as part of an extortion campaign.
stormous operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.
Plaintext authentication credentials (usernames/passwords)-(full names, dates of birth, gender)-(addresses, phone numbers, emails)-Employment history and professional skills-CNI-RIB - Relevé d'Identité Bancair - CDD, CDI, temporary missions - spanning multiple years - Tax documents (Avis d'imposition) - Social security attestations - Training certificates - Work authorization documents and more ....