Threat watch / Breach
CAF (France): data of 1.6 million families taken from the Vacaf holiday-aid platform
France's family benefits network (Cnaf) says data of 1,619,893 Caf beneficiaries was taken from vacaf.org, the platform of its holiday-aid scheme. CERT-FR says attackers used partner account credentials stolen by infostealers, with no two-factor authentication, and a URL flaw that exposed file identifiers, to extract data automatically between October 8 and 10, 2026. Names, beneficiary numbers, household make-up, family quotient and children's names and birth dates were taken; no bank data, passwords or contact details, the Cnaf says. The platform reopened on November 2 with two-factor authentication.
- Sector
- Government & politics
- Way in
- Stolen credentials
- Product or vendor
- None named
- How it happened
- According to CERT-FR, "the compromise of partner account credentials taken by infostealers (without two-factor authentication) and the exploitation of a URL exposing file identifiers (IDOR)" allowed an automated extraction of data between October 8 and 10. CERT-FR does not name the partners. vacaf.org is hosted by an external provider and run by the Caf de l'Hérault for the Caf network, the Cnaf said on October 10.[3][1] Checked 14 Nov 2026
- What was stolen
- Name, first name, the beneficiary's Caf and beneficiary number, household make-up and family quotient, and some information on children (name, first name, date of birth) and the holiday aid they are eligible for, the Cnaf says. "No bank data, nor any login password for Caf online services" is concerned, and no contact details (email, phone, postal address) were captured.[2][3] Checked 14 Nov 2026
- Who was impacted
- "1,619,893 Caf beneficiaries are concerned," the Cnaf says; CERT-FR counts nearly 1.2 million files. Benefit payments were not affected. New Vacaf bookings were suspended while the platform was offline from October 10 to November 2.[2][3][1] Checked 14 Nov 2026
- Threat actor
- Not attributed
Timeline
- Automated extraction of data from vacaf.org begins, lasting until October 10, according to CERT-FR. [3]
- The breach is detected after databases are put up for sale, according to CERT-FR. The Cnaf says a leak of beneficiaries' data was reported that evening. [3][1]
- The Cnaf announces the incident and suspends access to vacaf.org. It says ANSSI and the CNIL have been informed. [1]
- The Cnaf and the Caf de l'Hérault file a joint complaint with the Paris prosecutor. [2]
- The Cnaf publishes its findings: 1,619,893 beneficiaries concerned. vacaf.org reopens after intrusion tests, with two-factor authentication and stronger protection against malicious access. [2]
- CERT-FR's October REACTIV status report describes the entry point: partner credentials stolen by infostealers, without two-factor authentication, and an IDOR flaw. [3]