Between September 1 and 3, 2024, an outsider took over the account of one of Assurance Retraite’s social-action partners, the organizations that deliver home help to French retirees, and exported a file of the people receiving that help. The French national pension fund (Cnav) put the number of beneficiaries at about 370,000 and took the partner portal offline. Have I Been Pwned has now loaded 70,372 unique email addresses from that file. The exposed fields are names, dates of birth, physical addresses, phone numbers, email addresses, government issued IDs, income levels, marital statuses and family members’ names. The fund said no banking or payment data was taken and that much of the data is old. You can review the details on our Assurance Retraite data breach page.
What This Data Enables
When multiple points of personal data are exposed together, attackers can assemble a detailed profile of an individual. Here is what the specific data exposed in this breach enables:
- Identity impersonation: Combining full names, dates of birth, physical addresses, and government issued identification numbers allows criminals to impersonate an individual. They can use these records to attempt to pass identity verification checks with government agencies, service providers, or administrative portals.
- Targeted social engineering: Social engineering is the act of manipulating someone into sharing sensitive information or performing an action. Knowing someone’s income level, marital status, and family members’ names gives an attacker personal context. They can craft messages that reference genuine details, making fraudulent claims appear legitimate.
- Convincing phishing attempts: Phishing is a fraudulent attempt to steal sensitive information by pretending to be a trustworthy organization. Having verified phone numbers and email addresses enables scammers to send realistic text messages or emails that appear to come from official pension caseworkers or administrators.
Does This Touch Your Small Business?
For most American small businesses, the direct risk from this event is low. The people in this file are mostly French retirees who received home help through their pension fund, not working professionals, so few work email addresses are likely to be in it.
The indirect risk is personal. If someone on your team has a parent or relative retired in France, that relative may now get calls or messages that cite real family names, income details and ID numbers. Older people are a frequent target of this kind of scam, and a message that knows the family is much easier to believe.
What You Should Do This Week
Because the exposed data consists of personal identification records and contact details rather than account passwords, your immediate steps should focus on awareness and communication. Here is what you can do:
- Alert staff to targeted administrative scams: Remind your team to be skeptical of unexpected communications that reference personal or family details. Scammers often use legitimate names and addresses to trick recipients into lowering their guard.
- Verify agency requests independently: Instruct employees never to respond directly to unsolicited emails, phone calls, or text messages requesting government identification numbers or income details. Anyone receiving a notice claiming to be from a pension fund or government office should look up the agency phone number independently and call them directly.
- Point relatives to the official checker: Assurance Retraite has a page, “Fuite de données : suis-je concerné ?”, on lassuranceretraite.fr where a person can check whether they were in the file. Tell relatives to reach it by typing the site address themselves, never through a link in a message.
Data from Have I Been Pwned | Sources: TF1 Info, Assurance Retraite (archived notice) | Written with AI assistance and checked against these sources on October 20, 2026
Related
- Am I Breached? Check an address and get alerts
- Data breach directory
- Angel One Data Breach: 6.8M accounts from 2023 now searchable
A tool by Digital Checkmark