Loading story…
French holiday rental network Gîtes de France suffered a data breach in May 2026 affecting some of its departmental branches. Have I Been Pwned reported that the exposed data contained hundreds of thousands of customer records, including 118,000 unique email addresses, alongside names, phone numbers, postal addresses and booking details. A separate report from Cyberattaque.org described the leak as involving reservations for 389,000 customers; that figure is distinct from the unique email count.
Have I Been Pwned added the breach to its service on October 18, 2026. The combination of contact information and booking details could enable convincing reservation-related phishing and impersonation attempts. Affected customers should independently verify unexpected booking or payment requests through official channels. The supplied reporting does not identify the intrusion method or establish whether passwords or payment-card data were exposed.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
HaveIBeenPwned published a notification about the Gîtes de France breach to alert potentially affected users. The listing covers 118,000 unique email addresses exposed alongside customer contact information and booking details.
A data breach affected some departmental branches of the French holiday rental network Gîtes de France, exposing hundreds of thousands of customer records. The compromised information included 118,000 unique email addresses, names, phone numbers, postal addresses and booking details.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcehaveibeenpwned.com
Open sourcecyberattaque.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Basic-Fit disclosed a breach affecting about **200,000 customers in the Netherlands** after unauthorized access allowed attackers to download personal data before the intrusion was stopped. The exposed information included membership details, names, addresses, email addresses, phone numbers, dates of birth, and **bank account details**. The company said it notified affected customers and reported the incident to the Dutch Data Protection Authority, while media reports indicated the wider impact may extend beyond the Dutch customer base and raised questions about controls that failed to prevent large-scale data exfiltration. Booking.com also warned customers that unauthorized third parties may have accessed reservation-related information after suspicious activity was detected on a number of bookings. The potentially exposed data included customer names, email addresses, phone numbers, and other booking details submitted during the reservation process. Booking.com said the full scope of the incident remains under investigation, reset PIN codes tied to affected reservations, and urged customers to watch for suspicious activity and phishing attempts leveraging the stolen information.
Jun 29, 2026
Booking.com warned customers that unauthorized parties accessed personal information linked to some reservations, exposing data that may include booking details, names, email addresses, physical addresses, phone numbers, and information shared with accommodations. The company said it detected suspicious activity, contained the incident, changed reservation PINs, and notified affected guests, while stating that payment or other financial information was not accessed from its systems. Booking.com did not disclose how many customers were affected. The breach was disclosed amid broader fraud and cybercrime pressure on the travel platform, including phishing and impersonation scams targeting Booking.com users. Reporting also highlighted rising consumer complaints and scam losses tied to travel-booking fraud, as well as scrutiny from an earlier Booking.com incident in which phishing against hotel staff exposed data from more than 4,000 people and later resulted in a **€475,000** regulatory fine after delayed breach reporting in the Netherlands.
Jun 29, 2026
French telecommunications provider **Bouygues Telecom** disclosed a cyberattack that led to the exposure of nearly **6.4 million customer records**, including **5.7 million unique email addresses**. The compromised data reportedly included names, physical addresses, phone numbers, dates of birth, and **IBANs**, raising concerns about fraud and financial abuse. The company said affected customers were notified after detecting the intrusion into its services. French electronics retailer **Boulanger** also suffered a major breach in which more than **27 million rows of data** were exposed, including **2 million unique email addresses**. The leaked information reportedly included names, physical addresses, phone numbers, and even **latitude and longitude** data. Unlike the Bouygues incident, the stolen Boulanger dataset was later posted publicly on a hacking forum, significantly increasing the likelihood of downstream misuse, phishing, and identity-related abuse.
Jun 29, 2026