MediumData breachHIBP-GitesDeFranceupdated 25 Oct 2026, 13:32 UTC

Gîtes de France holiday rental customer data exposed in breach

Personal details of holiday rental customers, including email addresses and phone numbers, were stolen in a data breach. Anyone who booked through affected branches could receive scam emails or calls pretending to be the rental network.

Official source

Severity	MediumData breach
Being exploited?	UnclearNo reports either way yet
What to do	Check exposureTreat any unexpected message about a Gîtes de France booking as suspicious and verify it independently before acting.
How sure is this?	Official sourceBacked by an official source

How the attack works simplified

1Attacker breaches networkGîtes de France branch systems accessed in May 2026
2Customer records takenEmails, names, phones, addresses, bookings
3Phishing messages sentConvincing scams using real booking details
4Customer targetedVictim may trust message and share data
ResultCustomers face targeted scams and fraud

What happened

A May 2026 breach at the French holiday rental network Gîtes de France exposed customer records from some departmental branches, including about 118k unique email addresses along with names, phone numbers, postal addresses and booking details.

Why it is dangerous: Exposed contact and booking details make phishing and fraud attempts more convincing, particularly targeted at people with upcoming stays. Customers of affected departmental branches are at risk.

Are you affected?

You are affected if you made a booking or submitted your details through a Gîtes de France departmental branch whose customer records were included in the May 2026 breach.

Package / product	Affected versions	Fixed in
gites-de-france.com	see advisory	no fix yet

What to do

Be wary of unexpected emails, texts or calls about your Gîtes de France booking, and verify them by contacting the provider directly through its official website
Do not share passwords, bank details or payment codes in response to unsolicited messages
Use unique passwords and enable two-factor authentication on accounts where you reuse the same email

Timeline

18 Oct 2026, 04:50 UTC
Publicly disclosed
18 Oct 2026, 04:50 UTC
Reported by Have I Been Pwned · Have I Been Pwned

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Have I Been Pwned18 Oct 2026, 04:50 UTC

Technical details

ID: HIBP-GitesDeFrance
Disclosed: 18 Oct 2026, 04:50 UTC
On Zero Radar: before the radar started
Last change: 25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works