Infogreffe stored 3.7M passwords in cleartext for 19 years — CNIL fined it €250,000

Infogreffe is the economic interest group of France's commercial court clerks, selling certified company records through infogreffe.fr since 2001 (Minitel since 1987) — a public-service mission run by private legal officers. In December 2020 a user complained he had retrieved his own password over the phone by giving nothing but his name, and that the site stored passwords in cleartext. The CNIL's March 2021 online inspection confirmed far worse than the complaint.

Two violations. Retention: Infogreffe's own GDPR charter promised deletion 36 months after a user's last order, yet on 1 May 2021 the database still held names, addresses, phone numbers, secret questions and answers — and, for subscribers, IBAN and BIC — for 946,023 members and 17,558 subscribers inactive for over three years. No automatic anonymization existed at all; about a quarter of accounts sat past the limit.

Security: under a password policy untouched since 2002, passwords were capped at 8 characters with no complexity rules and no second factor, emailed in cleartext as permanent credentials, stored in cleartext, and users were never told when their password changed — every one of the 3.7 million accounts was exposed.

The defenses made it worse. Infogreffe argued security is only an obligation of means with no actual breach to show, dismissed CNIL password guidance as soft law, and blamed its processor — while never supervising that processor either. The committee called the failures structural: anonymization and security work had been postponed for unrelated compliance deadlines without extra resources, and as public officers the clerks owed particular rigor. Fine: €250,000, deliberation published 13 September 2022.

€250,000 CNIL fine; all 3.7M accounts ran on max-8-character passwords with no second factor; 963,581 dormant accounts kept past the site's own 36-month limit

The retention rule existed only on paper: the 36-month limit was written into Infogreffe's own charter, but no deletion or anonymization process was ever built, so records accumulated indefinitely.

Security debt from 2002 was never revisited: an 8-character password ceiling is only implementable by storing cleartext, and it silently governed all 3.7M accounts until June 2021.

Cleartext email delivery plus no change notifications meant one phished inbox or one persuasive phone call gave full account takeover — exactly what the December 2020 complaint demonstrated.

Management deprioritized the risk: anonymization and security projects were pushed back for non-privacy compliance work without extra resources, and blame was shifted to a processor no one checked.

A retention policy is a promise you can be fined for breaking: Infogreffe wrote a 36-month rule, then never built the deletion job. And security debt from 2002 does not age out on its own.

Infogreffe purged the accounts dormant for over 36 months once the CNIL inspection began, but the committee held the structural violations characterized for the past. The €250,000 fine and the published decision landed on 13 September 2022; under CNIL publication rules the company is anonymized from the deliberation after two years. The phone call that started it — a helpdesk handing back a password for nothing but a name — remains the cleanest demonstration that its authentication treated identity as a formality.