For a year and a half, the personal data of more than 10,000 beneficiaries of the Family Allowance Fund (CAF) were freely accessible on the internet. Revealed by Radio France’s investigative unit, this leak is not the work of a group of cybercriminals, but simply a CAF service provider. The publication of sensitive information dates from March 2021 as part of a training course for CAF agents.
To learn a programming language in the field of statistics, the Gironde CAF provided a file containing information on 10,204 people who benefit from the organization’s allowances. The service provider in charge of the training then puts them online. The only problem is that all this personal data is real.
I thought they were fictional
This batch of data was needed as part of the practical exercises that accompanied the training of the agents. “When CAF communicated these data to me, I thought they were fictitious,” the service provider, based in the Paris region, defended on Radio France. He also explains that he didn’t need real data to ensure his training, just realistic data.
Still accessible on January 1, the file in question has since been removed from the provider’s site. If the name and surname were removed from the batch of data, they were not anonymized, laments La Quadrature du Net. The association for the defense of fundamental freedoms in the digital environment indicates that addresses or dates of birth remain direct identifying data.
181 precise data per beneficiary
In addition, Radio France’s investigative unit had no problem contacting CAF recipients whose personal data was available online. This is how he found the identity of people by entering their address in a reverse directory. La Quadrature du Net specifies that a site like the Yellow Pages was sufficient for the operation.
In total, the free access file included 181 specific data for each of the recipients. Gender, nationality, date of birth, and address were displayed for everyone. Added information on housing, personal, medical, professional, and family situations. The activity of the spouses was mentioned, as well as the date of birth of the children of the beneficiaries. Finally, the amounts of the allowances received were detailed.
Source: BFM TV
