Vacaf, the holiday-aid service of France's family-benefit funds, was hit by a cyberattack. Up to 1.2 million families' names, children and benefit details may be exposed — no bank data, but a goldmine for phishing.
What happened
On 9 October 2026, the data-breach site French Breaches reported that files from Vacaf — the holiday-aid platform of France's family-benefit funds (Caf), run by the Cnaf — were being offered for sale on a criminal forum. The Cnaf confirmed a "cybersecurity incident" on 10 October, took vacaf.fr offline as a precaution and set up a crisis team with Vacaf and the Hérault Caf.
What is affected — and what is not
According to the attacker's claim, around 1.2 million files across benefit offices nationwide are involved: names, family situations and benefits, the identities and dates of birth of children, and holiday-camp booking details. The Cnaf stresses that its first analyses show no bank details and no Caf online passwords were exposed, and that benefit payments are not affected. The 1.2 million figure comes from the attacker, not from the Cnaf.
The real danger: targeted phishing
Even without passwords or bank data, this leak is a goldmine for fraud. With a family's name, children and the fact that they applied for holiday aid, a scammer can send a very convincing fake message — "complete your Vacaf file", "confirm to keep your aid" — that leads to a phishing page or a payment. The presence of data on minors makes it especially sensitive. The Cnaf says it will warn affected people individually and advise them against phishing, fraud and identity theft.
What to do now
- Treat any message about Vacaf or the Caf (SMS, email, call) with suspicion, even if it uses your name or your children's.
- Never pay, and never enter a password or card number to "keep" an aid.
- Go to the official site yourself instead of clicking a link in a message.
- In doubt, check the link or the email before you act — it takes two minutes.
This incident is a reminder that public platforms hold enormous amounts of personal data, and that a single exposed service can put millions of families at risk.
Sources
- France 3 / franceinfo — Plus d'un million de fichiers volés après une cyberattaque contre la Caf
- ICI — Fuite de données : le dispositif d'aide aux vacances des Caf victime d'une cyberattaque
- Cybermalveillance.gouv.fr — Hameçonnage (phishing) : que faire ?
How we choose, verify and write our analyses →
Check before you click, and check what your servers expose — free, no intrusion:
Worried your servers are exposed? Our team audits, patches and monitors Linux and cloud infrastructure 24/7.
Talk to an expert Our managed server services →
