A cyberattack compromised 1.2 million files from France's Vacaf program, exposing family data. The Cnaf has suspended access and is investigating the breach.
Cyberattack impacts French holiday assistance program
A cybersecurity incident has affected Vacaf, the summer holiday assistance program managed by the Caisse nationale des allocations familiales (Cnaf) in France. A hacker claims to have obtained information from nearly 1.2 million files, including personal data on families and their children.Hacker offers data for sale online
According to the website FrenchBreaches, a hacker is offering for sale files containing 1,191,967 holiday assistance files, distributed across 58 CAFs. Two other data sets are also involved: 97,269 files related to the Pass Colo and 101,322 records relating to children's stays.Details of the leaked data
The site explains that it examined 1,500 lines from these files: they include names and surnames of parents and children, dates of birth, CAF file numbers, family quotients, aid amounts, as well as dates and locations of stays. However, these figures should be relativized, as they do not necessarily correspond to that many different individuals.Cnaf responds to the breach
The exact circumstances of the leak are not yet known. The Cnaf explains that it has activated a crisis cell and suspended access to vacaf.org to prevent further unauthorized access. According to its initial analysis, the bank details of beneficiaries and passwords allowing access to CAF online services are not among the affected data.Next steps and impact on users
The CNIL and ANSSI have been informed, while the Cnaf has announced its intention to file a complaint. For beneficiaries, the Cnaf specifies that the payment of benefits is not affected, as the computer system responsible for payments is separate from Vacaf. Already booked stays remain valid.New reservations are temporarily blocked
However, new reservations on the platform are temporarily impossible, with no announced reopening date. The organization plans to contact individuals concerned once the extent of the breach is established. This incident adds to an already extensive list of cyberattacks against French administrations.Recent cyberattacks on French institutions
In 2024, France Travail was the victim of an intrusion potentially affecting the data of 43 million people. More recently, France Titres, the agency responsible for identity cards and passports, was also affected. This summer, hackers also targeted the tax authorities and the National Education system.
