---
title: "Data breach at VACAF (Caisses d'allocations familiales)"
description: "On 9 October 2026, an actor offered for sale on a criminal forum files presented as coming from VACAF, the holiday-aid scheme linked to the French family allowance funds (CAF). According to specialist outlets, they would include 1,191,967 beneficiary records spread across 58 funds, 97,269 Pass Colo "
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-10-09-vacaf-caisses-d-allocations-familiales
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-10-09
dateModified: 2026-10-09
---
# VACAF (Caisses d'allocations familiales)

Data breach — Moderate

On 9 October 2026, an actor offered for sale on a criminal forum files presented as coming from VACAF, the holiday-aid scheme linked to the French family allowance funds (CAF). According to specialist outlets, they would include 1,191,967 beneficiary records spread across 58 funds, 97,269 Pass Colo records and 101,322 rows of children's holiday-stay registrations, covering 2026 beneficiaries. Samples reviewed by FrenchBreaches (1,500 records) contain the names of beneficiaries and children, minors' dates of birth, CAF registration numbers, family quotients, household composition, as well as aid amounts and stay bookings. On 10 October, according to a FrenchBreaches update citing Le Parisien and AFP, the national family allowance fund (CNAF) confirmed the breach, temporarily suspended the vacaf.org website and announced it would file a complaint.

This information links the identity of families and minors to their family and financial situation, and could be used for targeted phishing attempts impersonating the CAF or a booked stay.

| Fact | Value |
| --- | --- |
| Disclosed on | October 9, 2026 |
| Sector | Public sector |
| Country | France |
| Cause | Credential stuffing |
| Severity | Moderate |
| Status | Confirmed |

## Exposed data

- Full name
- Date of birth
- Customer ID
- Order history
- Other personal data

## What you can do

- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [VACAF](https://frenchbreaches.com/alertes/vacaf-mv1973gh31stjwpfe8l) — FrenchBreaches
- [VACAF : fuite de données revendiquée portant sur 1,39 million de lignes](https://fuitesinfos.fr/article/2026-10-09-vacaf) — Fuites Infos
- [VACAF : 1,39 million de lignes en fuite, les données de familles et d'enfants exposées](https://www.cyberattaque.org/vacaf-cyberattaque-caf/) — cyberattaque.org

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-10-09-vacaf-caisses-d-allocations-familiales
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees