French Job Seekers Exposed: BFA-Emploi Leak Hits 73,874 Accounts

HEROIC analysts identified a data breach tied to BFA-Emploi, a French employment platform, first leaked on August 26, 2018. The exposed dataset contains 73,874 records, each pairing an email address with a plaintext password. The data was posted openly on a cybercrime forum, meaning anyone could read the passwords without needing to crack anything.

Why This Is Dangerous for Job Seekers

Plaintext passwords are the worst-case scenario in a data breach. There is no hashing to break, no encryption to bypass, the password sits there in readable form next to the email address it belongs to. For the job seekers who used this platform to search for work, that means anyone who downloads this list can immediately try logging into their email, banking, or social media accounts using the exact same credentials, no technical skill required.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

Job seekers often reuse the same password across multiple job boards, personal email, and even banking sites, especially years ago when this breach occurred. That reuse is exactly what makes plaintext leaks so damaging. Attackers run these credential lists against other popular services in what is known as credential stuffing, and every successful match can lead to account takeover, stolen personal information, or financial fraud committed in someone else's name.

How This Database Became a Combolist

This incident is classified as both a database breach and a combolist. It started as a database breach, meaning attackers gained direct access to BFA-Emploi's stored user records and pulled them out wholesale. From there, the stolen email and password pairs were stripped down into a combolist, a simple list format built specifically for automated login attempts against other websites. Combolists like this one continue to circulate for years after the original breach, which is why a leak from 2018 can still put people at risk today.

Check If You Are Affected

If you ever created an account with BFA-Emploi or have reused a password across job sites and other accounts, it is worth checking whether your details appear in this leak. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, so you can find out where your information has been exposed and update your passwords before someone else uses them first.