VACAF (Caisses d'allocations familiales)
ModerateConfirmedPublic sector
On 9 October 2026, an actor offered for sale on a criminal forum files presented as coming from VACAF, the holiday-aid scheme linked to the French family allowance funds (CAF). According to specialist outlets, they would include 1,191,967 beneficiary records spread across 58 funds, 97,269 Pass Colo records and 101,322 rows of children's holiday-stay registrations, covering 2026 beneficiaries. Samples reviewed by FrenchBreaches (1,500 records) contain the names of beneficiaries and children, minors' dates of birth, CAF registration numbers, family quotients, household composition, as well as aid amounts and stay bookings. On 10 October, according to a FrenchBreaches update citing Le Parisien and AFP, the national family allowance fund (CNAF) confirmed the breach, temporarily suspended the vacaf.org website and announced it would file a complaint.
This information links the identity of families and minors to their family and financial situation, and could be used for targeted phishing attempts impersonating the CAF or a booked stay.
- Disclosed on
- October 9, 2026
- Sector
- Public sector
- Country
- France
- Cause
- Credential stuffing
Exposed data
- Full name
- Date of birth
- Customer ID
- Order history
- Other personal data
You are only affected if you had an account or an order with this organisation.
What you can do
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact