A woman in Lyon asked her pension fund for help with housekeeping in 2024. To arrange it, she handed over her address and her French social security number. She also said roughly what she lives on each month. This week an email told her that file sits in a stranger’s hands. The Assurance Retraite data breach did not take her money. It took the paperwork that proves she is who she says she is.
Confirmation: confirmed by the company. Cnav, the national fund behind l’Assurance retraite, disclosed the theft on September 13, 2024. Then Have I Been Pwned’s analysis of the stolen file added the 70,000 email addresses and the relatives’ contact details on October 20, 2026. The company itself has not listed either.
What happened in the Assurance Retraite data breach
Attackers signed in as somebody else. Cnav announced on September 13, 2024 that thieves took the data of roughly 370,000 beneficiaries. The way in was the Portail partenaires de l’action sociale. That site exists for the outside providers who deliver home help to retirees. So the thieves did not break the door. Instead they used hijacked provider accounts and then pulled records out the normal way.
Cnav took the portal offline, reported the incident to the CNIL and filed a criminal complaint. The fund also said what the file did not hold. No banking data, no payment data, and nothing about anyone’s pension, career or benefits. According to AFP, the records then showed up for sale online. The same account was also selling data stolen from the French retailers Truffaut, Cultura and Boulanger.
Why the Assurance Retraite data breach is news again this week
Because the file itself just became searchable. On October 20, 2026, Have I Been Pwned loaded the breach and found 70,372 unique email addresses inside it. Anyone whose address sits in that set got a notification two days ago. For most of them, it was the first news of any of it.
The load also lengthened the list of what the thieves took. Cnav’s 2024 notice named addresses, social security numbers and an approximate income figure. But the file itself carries more. It also holds dates of birth, marital statuses and phone numbers. Worse, it holds the contact details of relatives or other nominated contacts. So we are flagging that gap rather than smoothing it over. Those four categories come from the breach analysis, not from the company’s own statement. The company has not updated its notice.
What was exposed, and what each item buys a scammer
One row of this file is a complete impersonation kit. Here is the honest accounting.
- The NIR, France’s social security number. It is the number an administration asks
- An approximate income figure. This tells a fraudster how big a lie to tell. Someone
- Relatives’ and nominated contacts’ details. This is the one people underestimate.
- Name, date of birth, postal address, phone number and email. Individually dull.
for to confirm you are you. It also cannot be reissued, so treat yours as public from today onward.
living on a small assistance payment gets a “your payment was suspended” message, not an offer of a loan.
For example, a stranger can call your daughter and name you. Then they name your pension fund and ask her for money on your behalf.
Together, they are what makes a fake letter from your pension fund look real.
What to do now
Most of this has nothing to do with us, and it matters more than anything we sell.
First, check whether your address sits in the set at haveibeenpwned.com. Then set one rule for yourself and keep it: nobody who contacts you gets to prove who they are. You prove who they are. So if a message about your pension asks you to confirm your identity, your bank details or your NIR, close it. Look up l’Assurance retraite’s own number yourself. Then call back on that number.
Second, warn the people in your contacts list, because they sat in the file too. Tell them one rule: they call you first, before anyone sends anybody anything.
Third, tidy up the accounts you can still control. Put your logins in a password manager, so none of them repeat. Then turn on the strongest sign-in each account offers. That means a passkey where one exists, and an app code where it does not. For the next several months, also expect the follow-up. It will be a phishing email dressed as the pension fund. Somebody who already knows your address and roughly what you earn will write it.
How OptMsg changes this exposure, and where it stops
Let us be plain about the limits first. OptMsg would not have prevented this breach. It happened inside a government portal, on stolen provider logins, and no inbox anywhere changes that. It also cannot un-expose a social security number.
What it changes is what reaches you next. In OptMsg, mail from a sender you have not approved goes to Trash, not your Inbox, and auto-deletes after 30 days. So the follow-up phish dressed as l’Assurance retraite arrives where you are not reading. That is the one carrying your real address to prove it is genuine. Our opt-in router is patent-pending, and OptMsg does not scan your emails to sell ads. Also, many other OptMsg users may already trust a sender whose message landed in your Trash. Community Recommendations then flags that message and alerts you before the 30 days run out.
The second half is structural. Your OptMsg account has no password, so a password stolen from another site can’t open your inbox. And your inbox is the reset route into nearly everything else. So a door that cannot open with a stolen credential keeps the rest shut too. That argument has a real edge, and we will name it. It does not cover a compromised device. Nor does it cover a live phishing page you type into, or somebody holding your unlocked phone. Read how the security-first design works, or create your inbox and try it.
Create Your Account
Your Inbox. Your Rules.
Frequently asked questions
Was I affected by the Assurance Retraite data breach? If you arranged social-action help through l’Assurance retraite before September 2024, you may be. Roughly 370,000 beneficiaries are in the file, and 70,372 email addresses from it were loaded to Have I Been Pwned on October 20, 2026. Searching your address there is the quickest check.
Was my bank account or pension payment exposed? No. Cnav stated that no banking data, no payment data and no pension, career or benefit records were in the stolen set.
Why am I hearing about a 2024 breach in October 2026? The theft was disclosed in September 2024, but the stolen file was only analyzed and indexed this week. That analysis also found email addresses, dates of birth, marital statuses and relatives’ contact details, which the original notice did not list.
Can I change my French social security number after a breach like this? No. The NIR is permanent, which is why the practical defense is to stop treating it as proof of identity. Anyone who already knows it has proved nothing.
What does the follow-up scam usually look like? A message that appears to come from the pension fund, quoting your real address or your approximate income, and asking you to confirm details or click through to a sign-in page. Verify by calling the fund on a number you looked up yourself.
Sources
- Have I Been Pwned, Assurance Retraite breach record, loaded October 20, 2026 — https://haveibeenpwned.com/Breach/AssuranceRetraite
- franceinfo, “L’Assurance retraite annonce s’être fait voler des données de 370 000 personnes,” September 13, 2024 — https://www.franceinfo.fr/internet/securite-sur-internet/cyberattaques/l-assurance-retraite-annonce-s-etre-fait-voler-des-donnees-de-370-000-personnes_6779392.html
- France Bleu / ICI, “L’Assurance retraite s’est fait voler des données, 370.000 personnes concernées,” September 2024 — https://www.francebleu.fr/infos/societe/l-assurance-retraite-s-est-fait-voler-des-donnees-370-000-personnes-concernees-1725350
- Orange Actualités (AFP), “Assurance retraite : les données de 370 000 bénéficiaires dérobées,” September 2024 — https://actu.orange.fr/france/assurance-retraite-les-donnees-de-370-000-beneficiaires-derobees-magic-CNT000002f1fdD.html
Previous in Breach Breakdown: The Nikkei Data Breach Is the Third One in a Month
Next in Breach Breakdown: Capcom Data Breach Exposes 11.7 Million Email Addresses And Sign-In Records
