Gîtes de France Breach: 117K Emails & Phone Numbers Exposed (2026)

Overview

In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting certain departmental branches. The incident exposed approximately 117,574 unique customer records, including 118k unique email addresses. The breach has since been reported to Have I Been Pwned (HIBP), confirming that the stolen data is now circulating publicly.

Gîtes de France is a well-known federation of rural holiday cottages across France, organized into departmental associations. Because each branch can operate its own booking systems and customer databases, the breach appears to have affected specific departments rather than the entire national network at once. This fragmented structure is part of what makes the incident notable.

For affected customers, the exposure centers on personal contact information and booking records. While no passwords or payment card numbers appear in the reported data, the combination of details is more sensitive than it first appears.

What Was Exposed

According to the HIBP listing, the breach includes:

• Email addresses - 118k unique addresses, the anchor for phishing and spam campaigns
• Names - full customer names tied to real identities
• Phone numbers - enables SMS scams, vishing calls, and WhatsApp fraud
• Postal addresses - physical location data, a privacy and safety risk
• Booking details - dates and property information revealing when homes may be occupied or empty

The severity is rated HIGH not because of financial data, but because the dataset is a near-complete profile for targeted social engineering.

Why This Combination Matters

Individually, a leaked email or phone number is annoying. Together with a name, home address, and travel dates, they form a convincing pretext. A scammer can call a customer by name, reference a real booking, and claim there is a problem with the reservation or payment - a classic fraud pattern that exploits contextual trust.

There is also a physical safety dimension: booking dates can reveal when a household is away. Criminals have used travel data to time burglaries, which is why postal addresses paired with booking records elevate the risk.

Recommended Actions for Affected Customers

• Treat unexpected calls and texts as suspicious. Gîtes de France will not ask for payment or card details over the phone or via SMS. Verify any contact through official channels first.
• Watch for phishing emails. Fraudsters may spoof Gîtes de France branding. Check sender addresses carefully and avoid clicking links in unsolicited messages.
• Consider a secondary email for future bookings to limit exposure of your primary account.
• Be mindful of shared booking details. If you travel during a known booking period, arrange for a neighbor or house-sitter to keep an eye on your property.
• Enable two-factor authentication on your email account, since it is the gateway to password resets across other services.

How to Check If You’re Affected

Visit the Have I Been Pwned breach page at haveibeenpwned.com/Breach/GitesDeFrance or search your email address on the main HIBP site. You can also subscribe to HIBP notifications to be alerted about future breaches involving your address. For ongoing coverage of similar incidents, see our cybersecurity news section.

Security Insight

Gîtes de France’s federated structure - dozens of departmental branches each running their own systems - means security standards likely varied from one branch to the next, and a single weak link exposed customer data network-wide. This mirrors the supply-chain pattern seen across hospitality and travel platforms, where decentralization increases the attack surface. The breach also shows that “only” contact and booking data can carry real-world physical risk, not just digital fraud.

Further Reading

• All High Breaches
• Recent Data Breaches