French authorities launch investigation into Vacaf platform data breach
French authorities investigate Vacaf platform breach affecting 1.2 million beneficiary records without banking data exposure.
Event / Security
Vacaf Platform Data Breach France
A cybersecurity incident on October 9, 2026, compromised approximately 1.2 million beneficiary records on the Vacaf platform, which provides vacation financial assistance to eligible French families. The breach was announced by the National Family Allowance Fund (Cnaf) on October 10. Banking data and access passwords were not affected. French authorities including Cnaf, Anssi, and Cnil initiated an investigation into the incident.
1 reported locations
Daily activity
1 articles0 articles
2026-10-10 to 2026-10-29 · UTC publication dates
Coverage begins 10 Oct, 21:37 UTC
Follow the documented timeline or explore the related reporting.
What happened
Data breach affects approximately 1.2 million family allowance beneficiary records
The cyberattack on the Vacaf platform compromised approximately 1.2 million beneficiary records according to the specialized website FrenchBreaches. The Cnaf has not independently confirmed this figure. The organization stated it would provide affected individuals with consolidated information about the incident's scope and recommendations to protect against potential fraud, phishing, or identity theft attempts.
French authorities initiated investigation into Vacaf data breach
The Cnaf announced that a formal complaint would be filed within hours of the incident discovery. The National Agency for Information Systems Security (Anssi) and the French data protection authority (Cnil) were notified of the breach and initiated investigations into the cyberattack.
Cybersecurity incident affects French family allowance vacation assistance platform
A cybersecurity incident affected the Vacaf platform, which provides financial assistance to eligible families for vacations and children's holiday activities, on Friday. The National Family Allowance Fund (Cnaf) announced the incident on Saturday, confirming that beneficiary data was compromised. Access to the vacaf.org platform was immediately suspended to secure the environment and prevent unauthorized access. A crisis management team was activated in response.
Compromised data excludes banking information and access passwords
The Cnaf confirmed that neither beneficiary banking data nor passwords for accessing Caf online services were included in the compromised data. The incident has no impact on the processing and delivery of family allowance payments by the Caf.
Read the coverage
2 alternative perspectives