CAF confirms data breach affecting Vacaf vacation aid beneficiaries

The Caisse nationale des allocations familiales (Cnaf, France's national family allowance fund) confirmed on Saturday, October 10, that a data breach had hit Vacaf, the service that manages vacation aid paid by the CAF (local family allowance offices). The breach had been reported the previous evening. In a statement, the organization refers to a "cybersecurity incident" affecting beneficiary data.

What we know

• The vacaf.org website has been suspended to secure the systems, and a crisis unit has been activated.
• According to Cnaf's initial analyses, bank details and passwords for the CAF online services are not among the exposed data.
• Benefit payments are not affected.
• ANSSI (France's national cybersecurity agency) and the CNIL (the French data protection authority) have been notified, and Cnaf has announced that it will file a complaint.
• Affected individuals are to be notified individually once the scope of the breach has been established.

The scale is still uncertain

Cnaf has not given any number of people affected. All the figures in circulation come from the hacker, who is selling the data on a forum: about 1.2 million records according to the monitoring site FrenchBreaches, and 1.39 million rows according to cyberattaque.org. The files reportedly cover 58 departmental CAF offices and contain, among other things, names, children's dates of birth, family quotients and aid amounts.

None of these figures has been confirmed. FrenchBreaches, which examined a sample of 1,500 records, points out that it cannot be used to authenticate the entire database. A number of rows also does not equal a number of people: the same family can appear in several files.

Best practices for beneficiaries

Even without bank details, information such as household composition or aid amounts makes it possible to write highly credible phishing messages. In the coming weeks:

• be wary of any text message, email or call claiming to come from the CAF or Vacaf, especially if it mentions a refund, an account adjustment or urgency;
• do not click on links you receive: log in directly at caf.fr;
• never share your bank details or codes by phone;
• if in doubt or if you fall victim to a scam, go to cybermalveillance.gouv.fr.