Breaches and incidentsBriefChecked against a primary source
France Vacaf (CAF family holiday-aid platform): beneficiary data leak, platform suspended
The national family allowance fund (Cnaf) said a leak of Vacaf beneficiaries’ data was reported on 9 Oct 2026.
- Disclosed
What happened
- The national family allowance fund (Cnaf) said a leak of Vacaf beneficiaries’ data was reported on 9 Oct 2026. The platform vacaf.org, hosted by an external provider and run by Caf de l’Herault for the CAF network, was suspended; early analysis found bank details and CAF online passwords were not involved. Count not stated.
- Root cause: under investigation; not disclosed.
- Attacker: not identified.
- Response: crisis unit, complaint, ANSSI and CNIL informed; benefits unaffected.
Sources
- https://www.caf.fr/professionnels/presse/publications/incident-de-cybersecurite-concernant-le-service-vacaf
- https://konbriefing.com/en-topics/cyber-attacks.html
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.