Cnaf Vacaf program hit by cybersecurity data breach

The Caisse nationale des allocations familiales (Cnaf) has reported a cybersecurity incident affecting its Vacaf holiday assistance program. Following the breach, access to the vacaf.org platform was suspended to secure the environment and prevent further unauthorized access. A crisis unit has been activated to manage the situation.

Preliminary analyses by the Cnaf indicate that bank details and passwords for online services were not among the compromised data. The organization also stated that the incident has no impact on the disbursement of benefits. While the Cnaf has not officially confirmed the scale, the specialized site FrenchBreaches claims the attacker is claiming responsibility for approximately 1.2 million beneficiary files.

The Cnaf plans to inform affected individuals directly once the full scope of the incident is understood, providing recommendations to protect against phishing or identity theft. A formal complaint will be filed, and both the French National Agency for the Security of Information Systems (Anssi) and the data protection authority (Cnil) have been notified.