2026 Gîtes de France — departmental booking data stolen via IT supplier; 117,574 emails (HIBP)
Data compromised
Names, email addresses, phone numbers, postal addresses and booking details (stay dates, nights). HIBP loaded 117,574 unique emails; press reports up to ~389,000 customers. Network says no bank data was collected.
Technical writeup
Gîtes de France confirmed the theft of customer data on May 17, 2026, limited to some departmental branches whose booking centres used IT supplier Itea; affected customers were informed. Actor ChimeraZ claimed data spanning 1995–2026. Have I Been Pwned added the breach on Oct 18, 2026 with 117,574 unique emails. Related: pierre-vacances-center-parcs-booking-leak2026. companyConfirmed true; recordsAffected = HIBP unique emails.
Root cause
Intrusion reported to originate at IT provider Itea, used by some departmental booking centres; same ChimeraZ campaign that hit Maeva (Pierre & Vacances) and Belambra.
References
- https://haveibeenpwned.com/Breach/GitesDeFrance
- https://www.mac4ever.com/securite/196204-pierre-vacances-belambra-et-gites-de-france-pirates-quelles-donnees-sont-concernees
- https://www.tourmag.com/Maeva-Belambra-Gites-de-France-le-tourisme-frappe-par-des-cyberattaques_a131783.html
- https://www.clubic.com/actualite-613192-hecatombe-dans-le-secteur-du-tourisme-francais-avec-plusieurs-grands-noms-frappes-par-des-fuites-de-donnees.html