Vacaf (CAF) data breach: how to spot a fake 'official' message and where to report it

On 9 October 2026 a hack of the Vacaf platform came to light. Vacaf is the CAF service families use for holiday aid and children's holiday camps (Pass Colo). L'Express and 6Médias report that the hacker claims to have taken data from around 1.2 million accounts across 58 local CAF offices; the Cnaf has not given a number. The Cnaf has confirmed the incident and says access to the platform has been suspended. It also says no bank details or CAF online-account passwords were taken, and benefit payments will not be affected. vacaf.org currently shows a notice saying it is closed for technical maintenance.

The specialist site Fuites Infos reports what the hacker claims: about 1.39 million records, including names, children's dates of birth, CAF beneficiary numbers (numéro allocataire), family quotient (quotient familial) and aid amounts. That list comes from the hacker, and the Cnaf has not confirmed it.

Why this matters even if you never used Vacaf

A data breach does not take money out of anyone's account by itself. The danger is what tends to follow: emails, texts and calls from someone who knows your real name, your child's name or your CAF number. The more accurate the details, the more convincing the message. Fakes are especially hard to spot if you are new to France and not yet used to how French public bodies write to people.

This has happened before. In March 2024 the CNIL investigated a breach at France Travail. It warned that leaked data can be combined with data from earlier breaches, so people need to stay alert both now and over the longer term.

How to spot a fake

Cybermalveillance.gouv.fr, the government's support service for victims of cybercrime (phishing page, updated 07/05/2026), recommends that you:

• never give confidential information by email, messaging app or phone;
• hover over a link before clicking to see where it really goes;
• check that the website address matches the organisation's exactly, because in a fake address sometimes just one character has been changed;
• contact the organisation directly if in doubt.

Service-public (article of 28/08/2026) adds: never send codes, passwords or bank details when asked, and type the website address yourself instead of clicking a link in a message.

If you have already clicked or entered details

Cybermalveillance.gouv.fr recommends these steps:

1. If you entered payment details, call your bank at once to block the card or account.
2. Change the password on that site and on any other site where you used the same one.
3. Keep the evidence: the message itself and screenshots.
4. File a complaint (plainte) at a police station or gendarmerie, or with the public prosecutor.

Where to report

• scam text messages: forward to 33700 or use the 33700.fr website;
• suspicious emails: signal-spam.fr;
• fake websites: phishing-initiative.fr;
• Info Escroqueries hotline: 0 805 805 817;
• any cybercrime: 17cyber.gouv.fr (listed by service-public);
• free victim support: France Victimes, 116 006, 7 days a week, 9am to 7pm.

For the longer term

Service-public recommends long, complex passwords that are different for every site, kept in a password manager. It also recommends two-factor authentication wherever it is offered and regular updates for software and devices. You can ask organisations to delete your data: this is the right to erasure, explained by the CNIL.

On 1 October 2026, for Cybermois (cybersecurity month), the CNIL and cybermalveillance.gouv.fr published a guide called "Violation de données personnelles, que faire en 3 étapes clés ?". It covers what to do from the day you learn of a breach up to day 30.

Sources: service-public.gouv.fr (published 28/08/2026), cybermalveillance.gouv.fr (updated 07/05/2026), CNIL (01/10/2026). On the incident itself: L'Express / 6Médias, 10/10/2026; Fuites Infos, 09/10/2026.