2024 Assurance Retraite — social-action partner portal breach; ~370,000 beneficiaries (70,372 emails in HIBP)
Data compromised
Names, dates of birth, postal addresses, phone numbers, email addresses, French social security numbers (NIR), approximate income, marital status and contacts of relatives. No bank, pension-payment or benefits data per the fund.
Technical writeup
Verified Assurance retraite press release (Sep 13, 2024): data of about 370,000 beneficiaries of social-action assistance exposed through hijacked partner accounts on the PPAS portal; the portal was taken offline, the CNIL notified and a complaint filed. AFP reported the data was offered on BreachForums by the same seller as Cultura, Boulanger and Truffaut data. Have I Been Pwned added it on Oct 20, 2026 with 70,372 unique emails. companyConfirmed true.
Root cause
Compromised accounts of social-action service providers that used the PPAS partner portal (Portail Partenaires de l’Action sociale).