Vacaf: 1.62 million beneficiaries affected, and the sensitivity of a family file

Incident identified on October 9, 2026; Cnaf report published on November 2. The Cnaf establishes that 1,619,893 beneficiaries are affected by a leak on Vacaf, the vacation aid platform. The total comes from Cnaf’s investigation, not from a sample presented by a hacker. This confirmed count lets us describe the known scope without inventing the technical path of the intrusion, which this press release does not detail.

What a Vacaf record reveals

Depending on the situation, the data collected includes name, first name, responsible CAF office, beneficiary number, household composition, family income quotient, information on children (including last name, first name and date of birth) and eligibility for certain vacation aid. Cnaf specifies that no banking data, no Caf password and no contact details (email, telephone, address) were captured. Not all fields are present for each person.

The absence of an IBAN or password does not make this file harmless. The family income quotient and eligibility reveal part of the economic situation; the composition of the household and the age of the children make it possible to construct a very credible fraud message. A scammer who knows a child’s name and expected aid can claim that a Vacaf file needs to be “validated” and then ask for payment or lead to a fake login page. This is a plausible risk, not a fraudulent campaign that Cnaf would have attributed to this incident.

What we can and cannot rebuild

The date October 9 corresponds to the identification of the incident. The November 2 report sets the categories and number of beneficiaries after investigation. It does not publish any CVE vulnerabilities, access vectors, raw volume of copied records, or technical evidence allowing the attack to be replayed. An article that explains SQL injection or administrator account takeover as the cause of this case would go beyond the available facts.

The relevant audit approach nevertheless remains concrete: inventory the accounts and service providers capable of exporting files, log large requests and exports, limit the family data accessible by role and check the retention period. In responding to the incident, each person must receive a notice tailored to the fields actually affected, so as not to confuse family exposure with leakage of means of payment. Cnaf indicates that it has informed beneficiaries individually and prepared a reopening of Vacaf after extensive security tests.

Main source: Cnaf press release of November 2, 2026.