Assurance Retraite Breach: 70K Names & SSNs Exposed (2026)

Overview

Assurance Retraite, France’s national pension fund, has confirmed a data breach affecting approximately 70,372 account holders. The intrusion took place in September 2024 and was attributed by the fund to a compromised partner account, a supply-chain style failure that exposed sensitive beneficiary records rather than the fund’s own perimeter. The compromised data spans 370,000 assistance beneficiaries overall, but a subset of 70,372 unique email addresses has been confirmed and loaded into Have I Been Pwned (HIBP), making individual verification possible for the first time.

The breached fields are unusually broad for a pension provider: email addresses, full names, phone numbers, physical addresses, dates of birth, French social security numbers (NIR), income levels, marital statuses, and contact details for relatives or nominated third parties. This is the data set a fraudster needs to impersonate a beneficiary to a government office or a bank.

What Was Exposed

Each exposed field carries a distinct risk. Names and addresses enable convincing phishing letters and phone calls. Phone numbers open the door to SIM-swap and vishing attacks. Dates of birth are a primary identity-verification factor used by banks and insurers.

The most damaging element is the French social security number (NIR). Unlike a password, an NIR cannot be reset. It is a permanent identifier tied to health coverage, pensions, and employment records. Combined with a name and date of birth, an NIR is enough to open fraudulent credit lines, file false tax claims, or impersonate a person with the French healthcare system.

The breach also leaked income levels and marital statuses - information that turns a generic phishing email into a targeted, financially literate one. The presence of relatives’ contact details extends the risk to people who never had an account with Assurance Retraite at all.

How the Breach Happened

Assurance Retraite attributed the incident to a partner account that had been compromised. This is a textbook third-party breach: an external organization with legitimate access to beneficiary data, whose credentials were not adequately protected. The named institution was not the direct target, but it is the entity legally accountable to the affected individuals.

The disclosure came with a delay of months between the September 2024 incident and public notification, a pattern that has drawn scrutiny from European privacy regulators. Under GDPR, controllers are expected to notify affected individuals without undue delay.

Identity Theft Risks

The combination of NIR, date of birth, name, and address is what French authorities refer to as a full identity kit. With these fields, a criminal can file a benefit claim in a victim’s name, request a duplicate carte Vitale, or attempt to redirect a pension payment. Because the NIR is not changeable, victims may face years of monitoring and disputes.

Elderly beneficiaries - the core demographic of the assistance program - are disproportionately attractive to fraudsters. A phone call referencing the correct marital status and income bracket will sound credible to someone unfamiliar with social engineering.

What to Do Right Now

Check whether your email appears at haveibeenpwned.com/Breach/AssuranceRetraite. If it does:

• Freeze your credit reports with the Banque de France’s FICP and contact your bank to flag suspicious account activity.
• Request an NIR usage audit through your local Caisse d’Assurance Retraite and ask for a written confirmation of what activity exists on your account.
• Treat unsolicited calls as hostile. Assurance Retraite will not call to ask for your NIR or a password. Verify any contact by calling the official number on ameli.fr.
• Warn your listed relatives. Their names and phone numbers are in the dump and are already being used in follow-up scams.
• Enable two-factor authentication on any account that uses the exposed email address, especially banking and email.

Follow cybersecurity news for updates on the regulator’s investigation.

Security Insight

A national pension provider sitting behind a compromised partner account is not an isolated failure; it mirrors a steady pattern across European public-sector benefits agencies, where third-party integrators are granted broad data access but are rarely subject to the same credential and access-management standards as the primary agency. The Assurance Retraite case also illustrates why breach severity cannot be measured in headline account counts: the 70,372 compromised emails understate the harm, because the NIR and family contact data they carry can be weaponized against tens of thousands of people who never received a notification.

Further Reading

• All Critical Breaches
• Recent Data Breaches