Massive data breach exposes CAF vacation aid records, including minors' details

Hackers have uploaded a substantial collection of VACAF beneficiary records to a cyber-crime forum, exposing sensitive details of families receiving state-funded holiday assistance. The compromised files span 58 CAF branches and include personal identifiers such as names, minors' birth dates, CAF numbers, household composition, benefit levels and vacation reservations, while omitting contact information like emails or phone numbers.

The data set relates to the 2026 beneficiary cohort and was made public on 9 October. Security analysts warn that the absence of two-factor authentication on some accounts facilitated the intrusion and that the information could be leveraged for sophisticated phishing campaigns impersonating CAF or related agencies. This incident follows earlier leaks affecting CAF systems, including a 2025 breach of the Pass’sport scheme, and adds to a recent wave of large-scale data exposures in France. Officials have not yet confirmed the breach publicly.