On 8 September 2026, the group Rhysida claimed a cyberattack against SAD'S Interim, a network of employment agencies present in France in the construction, logistics and medical sectors. The data published as evidence includes payslips, employment contracts, passports, social security numbers (NIR), bank statements and documents attesting to a disability. More than 8,000 temporary workers are potentially affected. This case illustrates a structural vulnerability that is little documented: temporary staffing agencies hold, by nature, a concentration of some of the most sensitive data that the GDPR recognises.
Why temporary staffing agencies are high-value targets
An attacker who compromises the information system of a temporary staffing agency gains access, in a single move, to several categories of protected data.
The first is the NIR. In France, the national identification number for natural persons (NIR) is governed by Article 87 of the GDPR, which refers to national legislation, and by Article 22 of the French Data Protection Act (loi informatique et libertés). Its processing is subject to strict conditions, and its disclosure directly exposes individuals to identity theft. A NIR combined with a complete civil status constitutes a ready-to-use fraud document.
The second category is health and disability data. Documents attesting to a disability constitute health data within the meaning of Article 9 of the GDPR, a special category whose processing is prohibited by default unless an explicit exemption applies. In the employment context, their processing is authorised, but their protection requires enhanced security measures. Their disclosure is directly harmful: hiring discrimination, impact on insurance cover, stigmatisation.
The third category is the bank statement. In the context of temporary work, bank details are processed to pay wages. Once exfiltrated, they enable fraudulent transfers and targeted social engineering attempts.
These three categories combined (NIR, health and disability data, bank details) define a high-risk breach for the rights and freedoms of the data subjects. This classification changes the obligations that follow.
What the GDPR requires after such a breach
Article 33 of the GDPR requires the controller to notify the breach to the competent supervisory authority, in France the CNIL, within 72 hours of becoming aware of it. This period does not start when the data is exfiltrated: it starts when the organisation became aware of the breach. Rhysida's public claim, with publication of data samples, constitutes a moment of awareness within the meaning of Article 33.
Article 34 goes further. Where the breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller must also notify the data subjects without undue delay. The presence of health data, NIRs and bank details in the exfiltrated data pushes the classification almost automatically towards high risk. Notification to individuals becomes mandatory, unless it can be shown that the data was encrypted or that subsequent measures have made the risk unlikely.
This dual level of notification, CNIL and individuals, is the central mechanism that teams must have prepared. For 8,000 people, individual communication is a non-trivial logistical operation to conduct under pressure.
Rhysida's double extortion model
Rhysida operates on a double extortion model that has become standard among sophisticated ransomware groups: encryption of the victim's data, exfiltration, and a threat to publish the latter. According to Breachsense, as at 1 September 2026, Rhysida's leak site listed 295 victims, 54 of them in the past twelve months. The seven-day window granted before final publication is calculated pressure: short enough to discourage a thorough investigation, long enough to create an illusion of room for manoeuvre.
This window creates a specific problem under the GDPR. If the organisation waits for the end of the deadline before notifying, hoping for a resolution or a negotiation, it risks letting the 72 regulatory hours pass without notifying the CNIL. The CNIL has been clear in several recent decisions: uncertainty about the exact scope of the breach does not exempt from notification within the deadline. It merely justifies an initial partial notification, supplemented later.
What your organisation must prepare
Three concrete actions reduce exposure.
The first is the classification of your HR data. Map precisely which categories of personal data your organisation holds on its employees and contractors. If this mapping reveals health data, NIRs or directly exploitable financial data, you have a high-risk scope that requires specific security measures (strict access controls, encryption at rest, access logging) and a notification plan prepared in advance.
The second is testing your detection time. Rhysida claimed the attack against SAD'S Interim on 8 September 2026. If your organisation has no data exfiltration detection mechanisms, your awareness may only occur when the attacker makes the incident public, at the very moment the 72-hour period starts to run. Reducing this detection time is an operational priority directly linked to your ability to comply with Article 33.
The third is preparing the individual notification process. Most organisations have a CNIL notification process. Many do not have an operational process for notifying several thousand people at once. This process includes drafting the message, identifying available contact channels, managing responses and answering requests for information. Without this process prepared, Article 34 becomes an unmanageable emergency at the worst possible moment. The article on coordinating GDPR and NIS2 notifications after an incident describes the steps to sequence in order to meet the deadlines of both regimes simultaneously.
The employment sector as a blind spot in data governance
Most post-incident commentary focuses on technical measures: encryption, network segmentation, backup. These are prerequisites. But the specificity of the temporary staffing sector is as much legal as technical: the data processed belongs to categories that multiply obligations in the event of an incident. An organisation that knows it processes health data and NIRs must have calibrated its security measures and notification procedures accordingly, before the incident, not in reaction to it.
The attack on SAD'S Interim is not an isolated case. Over the whole of 2026, France recorded more than 87% additional cyberattacks compared with the previous year (Global Knowledge, July 2026). The HR and temporary staffing sector was not identified as a priority in the security plans of most of the organisations concerned. The incident of September 2026 changes that calculation.