A breach in a country you only visit

Every organisation in this week's record is French. That has not been true of a window in this series before, and it changes the question a British reader should be asking. Not how big it was — whether your life has ever touched France. A holiday booked through a French network, or a working life in France that ended in a claim on the French pension system, are the routes in. If your life has touched France in none of those ways, the answer this week is that you are not in it, and we would rather write that down than find you something to worry about.

Who is in it

Gîtes de France is the rural self-catering network — the gîte, the chambre d'hôte, the farm cottage booked for a fortnight in the Dordogne. British holidaymakers use it heavily and book it directly, which makes this the entry a British reader is most plausibly in. The exposed records are booking files: names, email addresses, phone numbers, home addresses and the dates and length of stays.

There is a complication worth knowing, because it decides whether checking is even possible. Gîtes de France is a federation of departmental associations rather than one company, and the fraudulent access reached booking records held by some of those branches, not all of them. Nobody outside has published which. So the brand on your confirmation email does not tell you whether your booking was in an affected system, and the only way to find out is to test the address you booked with against what is actually in the record.

Assurance Retraite is the French state pension fund, and the records taken were from its social action side — the budget that pays for help at home, adaptations and support for older people on low incomes, rather than pensions themselves. The fund's own statement puts the figure at around 370,000 beneficiaries and says much of the data is old, and that some of the people in it have since died. A British reader is in this one only if they worked in France, drew a French pension, and applied for that kind of assistance. That is a narrow group, and it is a fair description of a lot of retired expatriates.

Everything added this week

Below is what the record gained in the seven days to 23 October. Where a figure is shown it counts account records rather than people: one person who booked under a work address and a home address appears twice. Treat it as the size of the pile, not the size of the crowd.

• Assurance Retraitelassuranceretraite.fr · 70,000 accounts · added 2026-10-20

  Exposed dates of birth, email addresses, family members' names, ID document numbers and income levels.

• Gîtes de Francegites-de-france.com · 118,000 accounts · added 2026-10-18

  Exposed booking details, email addresses, names, phone numbers and home addresses.

What was in it

No entry in this window lists a password, so the advice that normally follows a breach applies to none of it. What these carry instead is the layer with no reset.

• Home addresses and phone numbers are in everything here. A holiday booking adds the dates you were away and how many nights you stayed, which is a travel history rather than a contact detail — and a convincing opening line for somebody who rings you claiming to be the agency.
• The pension records add dates of birth, marital status, an approximate figure for the person's income, and the French social security number, which Have I Been Pwned's field list calls a government-issued ID. A national identity number cannot be changed on request in France any more than a National Insurance number can here.
• The pension records also carry family members' names and contact details — the relative or neighbour an older person names on an assistance file. Those people did not apply for anything, were never customers, and have no account anywhere to check. They are in a breach because somebody they care about filled in a form honestly.

Nothing here was taken from the front door

The route into each is worth more than its total. At Gîtes de France it was the branches: departmental associations holding booking records for the national brand, breached in mid-May as part of a run of attacks on French holiday operators over a single weekend — Maeva, in the Pierre & Vacances group, and Belambra were hit in the same 48 hours, and French reporting attributes the set to one actor. Gîtes de France confirmed the theft, said it could concern more than 389,000 clients, and said no banking data could be collected.

At Assurance Retraite it was the suppliers. The fund says the leak was carried out by impersonating the accounts of social-action service providers — the companies that deliver the help it pays for — through the partner portal those firms log into, which was taken offline. The incident was disclosed in September 2024 and notified to the CNIL, the French regulator, at the time; the data only became checkable by the people in it this week, two years later.

What to do, and who to ask

• Nothing here calls for a password change. No entry in this window lists one, and no password change removes a home address from anywhere.
• Treat an unexpected call or email that already knows where you stayed and when as unverified by default. Booking data is what makes a refund scam sound like it came from the agency. Go back through the website or a number you looked up yourself, never a link or a number in the message.
• Your data protection rights do not depend on where you live, but the regulator does. These organisations are established in France, so the authority that supervises them is the CNIL rather than the ICO — the ICO's remit is UK data protection law, and it cannot act against a French controller on your behalf.
• The exposure that outlasts all of this is the home address. A breached address does not stay with the people who took it; it is bought, matched and resold by firms whose entire business is assembling exactly the fields listed above, and that trade does not care which country lost them.

Every holder we act against is published by name, so the claim is checkable rather than a promise. The coverage list marks which of them carries a home address.