Hackers pulled CAF family files without any sophisticated technique

For three days, from October 8 to 10, family files were siphoned from vacaf.org, the site that manages vacation aid for the French family allowance funds (CAF). Behind this leak, no sophisticated technique: stolen partner account credentials, and a web address that exposed file numbers.

The account appears in the second situation update on Operation REACTIV by the French National Cybersecurity Agency (ANSSI), published on November 12 by its alert center, CERT-FR. Launched on September 1 at the request of the Prime Minister, this program lets the agency impose emergency measures on ministries to counter data theft. Since the previous update on September 30, 64 new data breaches have been reported to the agency, five of which affect ministries or bodies under their authority. For this scope, the agency notes "a significant decrease."

At the CAF, partner accounts without two-factor authentication

The credentials came from "infostealers," programs designed to steal information such as login data. These partner accounts had no two-factor authentication. The address that exposed file identifiers then allowed automated extraction. The leak was detected on October 9, after databases were put up for sale.

According to ANSSI, nearly 1.2 million files are affected: names, CAF registration numbers, family quotient, minors' identities, aid and bookings, but no banking data or passwords. The national family allowance fund (Cnaf) had put the number of affected beneficiaries at 1,619,893 on November 2, all notified by email. ANSSI counts files, Cnaf counts beneficiaries, and the report does not reconcile the two figures. According to Cnaf, vacaf.org reopened on November 2 with two-factor authentication, after penetration tests.

At France Travail, the SMS code was validated

On September 26, data was extracted from France Travail (the French public employment agency) using an agent's account, whose second factor, a code sent by SMS, was validated. On October 8, the sale of data on more than 60,000 agents and professionals was claimed on a cybercriminal forum: names, work email addresses, phone numbers, job titles, offices and internal identifiers. The report does not say how this second factor was validated.

At the Ministry of Agriculture, the story ended better. Thanks to shared indicators of attack, it spotted compromised VPN certificates, but two-factor authentication prevented the attacker from logging in.

The report also lists new leaks at the French Biodiversity Office (more than a thousand people, including minors, via the hunting license portal), at the Services and Payment Agency (30,500 users notified) and at the Ministry of Foreign Affairs, where an intruder reportedly accessed the data of about a hundred users of the libraries portal.

Always the same entry points

No new weakness, the agency stresses. These are the ones already noted in September: no two-factor authentication or weak authentication, service providers and subcontractors, accounts stolen by infostealers, access control flaws as at the CAF, and development and configuration errors. The recurring technique consists of reusing stolen secrets to get into an application and extract the data "in a legitimate way." ANSSI had already noted, in a feedback report published on October 20, that many application data breaches occurred without exploiting any technical vulnerability.

It does note "significant" progress, particularly on two-factor authentication, and puts the interministerial progress on the 2026 objectives of the State's digital security roadmap at 70%.

What should your organization do?

There was no technical feat in these leaks, so ANSSI's remedies are worth applying well beyond the State. The agency recommends starting with the first item and combining it with the following ones:

• renew passwords and other secrets that are compromised or suspected of being so;
• enforce strong authentication and strictly control privileged accounts;
• tighten access filtering to prevent data exfiltration;
• strengthen the security of applications exposed to the Internet or to third-party networks.

The CAF case also calls for taking inventory of the accounts opened to partners. For beneficiaries, Cnaf advises being wary of messages that create a sense of urgency or mention family circumstances, and going directly through caf.fr.

The next situation update will show whether October's decline is confirmed. One question remains open: how was the France Travail agent's SMS code validated?