Data security when outsourcing can never be delegated entirely: the company entrusting personal data remains responsible for selecting, supervising, and monitoring its service provider. The VACAF incident confirmed by Cnaf on October 10, 2026, illustrates a common risk: an external platform may be compromised while the main information system remains isolated. Contracts, access, logs, and incident procedures must be defined before going live.
What does the VACAF breach reveal about the risks associated with service providers?
The VACAF incident shows that a service hosted by an external provider can expose data without compromising the main information system. On October 10, 2026, Cnaf confirmed a cybersecurity incident and suspended vacaf.org, while the systems used to manage and pay Caf benefits remained separate and operational.
VACAF is the vacation assistance service operated by the Caf network. According to Cnaf’s official communication on October 10, 2026, the platform was operated by Caf de l’Hérault and hosted by an external provider. New reservations were suspended, but existing reservations and the payment of benefits remained valid.
This technical separation limited the operational consequences. Initial findings also ruled out beneficiaries’ bank details and passwords for Caf online services. However, as of October 13, 2026, the provider’s identity, the attack vector, the precise timeline, and the complete list of exposed fields had not been made public.
The figure of approximately 1.2 million records, reported on October 13, 2026, by Le Monde Informatique based on a claim attributed to FrenchBreaches, had not been confirmed by Cnaf. It should therefore not be presented as an established assessment. During a cyber crisis, distinguishing an official fact from a claim helps prevent further confusion.
Who remains responsible for the security of outsourced data?
The data controller remains accountable for selecting and supervising its processor, while the service provider must implement the required security measures. Article 28 of the GDPR, adopted in 2016, requires sufficient guarantees, a binding contract, and the transfer of equivalent obligations to any subsequent processors.
The data controller is the organization that decides why and how personal data are used. The processor handles that data on the controller’s behalf: a hosting provider, web agency, SaaS publisher (software accessible online), email marketing provider, or application maintainer.
Signing a data processing agreement is not enough. Article 32 of the 2016 GDPR requires the controller and the processor to implement measures appropriate to the risk, which may include encryption, system resilience, data restoration, and regular testing. The security of outsourced data is therefore a shared responsibility, but not a diluted one.
The same logic applies when a provider delegates hosting, backups, or email delivery to another company. The contractual chain must remain visible. This dependency mechanism also recalls the cascading effect of NIS2 on subcontractors, even though the exact obligations vary depending on the organization’s activity and status.
What should be verified before entrusting data to a service provider?
Before entrusting personal data, a company must map the information being processed, identify access rights, verify subsequent processors, and obtain verifiable guarantees. In 2024, CNIL recommended establishing controls for authentication, authorizations, incident reporting, the return or deletion of data, and security reviews.
A data map indicates what information enters the service, where it is stored, who can access it, and when it is deleted. Without this overview, it is impossible to correctly assess the impact of a breach or determine whether a test database still contains real customer data.
Useful checks follow a concrete order:
- describe the categories of data, their purposes, and their retention periods;
- identify administrators, technical accounts, and support access;
- identify the hosting provider and each authorized subsequent processor;
- require logging—that is, usable records of connections and sensitive actions;
- provide for encryption, backups, restoration, and regular security testing;
- establish a procedure for returning or deleting data at the end of the contract;
- define the notification channel and deadline in the event of an incident.
In 2024, CNIL stated that guarantees may be verified through audits or on-site inspections. It specifically recommends examining encryption, traceability, authorization management, network protection, and administrative practices. A commercial certification without a defined scope or date provides few guarantees.
In the projects we lead, we often see one overlooked risk: an administrative account shared by several contributors. It reduces traceability and makes access revocation more difficult. A named account, multifactor authentication, and permissions limited to the assignment are generally more robust choices.
What security clauses should be included in the contract?
An outsourcing contract must turn security promises into verifiable obligations: data scope, technical measures, access management, subsequent processors, assistance, auditing, and incident notification. In 2024, CNIL also recommended establishing rules for returning or deleting data at the end of the service.
The following table connects the clauses with their concrete consequences for a web or mobile project.
| Contractual item | Verifiable requirement | Risk reduced |
|---|---|---|
| Access | Named accounts, limited permissions, and documented revocation | Persistent or unattributable access |
| Traceability | Connection and administrative logs retained for a defined period | Incident impossible to reconstruct |
| Subsequent processing | List of parties, location, and authorization or notification procedure | Unknown technical chain |
| Incident | Prompt alert, emergency channel, and required minimum information | Late regulatory notification |
| End of contract | Return, export format, deletion, and proof of erasure | Data left with the former provider |
| Control | Right to audit, dated supporting documents, and remediation plan | Guarantees impossible to confirm |
The classic contractual pitfall is accepting a vague clause such as “measures consistent with best practices.” Honestly, such a broad formula offers the project little protection: it specifies neither the controls, the responsibilities, nor the expected evidence. A useful contract describes what can be verified without imposing a rigid architecture.
The budget must also provide for maintenance after delivery. Security fixes, account reviews, and component updates are not one-time options. A process of managing updates without production downtime helps clarify responsibilities between the company, the agency, and the hosting provider.
How should you respond when a service provider reports a data breach?
When a service provider detects a personal data breach, it must notify the data controller without undue delay. According to the procedure published by CNIL in 2018, the controller documents each breach and, when a risk exists, notifies CNIL, if possible within 72 hours of becoming aware of it.
A personal data breach is a breach of the confidentiality, integrity, or availability of information that can identify an individual. This may involve unauthorized access, modification, loss, or unavailability.
The first response is to preserve evidence while containing the incident: suspend a compromised access method, isolate the service if necessary, and retain logs. Cnaf consequently suspended access to vacaf.org on October 10, 2026, activated a crisis unit, informed the National Agency for the Security of Information Systems and CNIL, and then announced that it had filed a criminal complaint.
If the breach poses a high risk to individuals, they must also be informed. The message must distinguish between data confirmed to have been affected and data that has not. For VACAF, Cnaf stated on October 10, 2026, that, according to the initial findings, banking data and Caf passwords were not affected.
On the agency side, the best practice is to prepare this sequence before an incident: emergency contact information, authorized decision-makers, a register template, and an evidence-collection procedure. Lessons learned from security incidents affecting an email service provider also show that a peripheral service deserves the same discipline as a core application.
How can you limit the impact of an external compromise?
Impact reduction relies on segmentation, limiting data and access, and maintaining a tested restoration capability. The 2026 VACAF incident illustrates the value of segmentation: the affected platform was technically separated from the system used to manage and pay Caf benefits, which continued to operate.
Segmentation prevents an incident affecting one service from automatically opening access to others. An event platform, an extranet, or an email tool should not have permanent access to the entire customer database. At this level of risk, it is better to exchange only what is strictly necessary than to replicate a complete database for convenience.
Data minimization also reduces the consequences: the less information a platform stores, the less a compromise can expose. For a mobile application, this approach begins at the design stage; the principles of data protection by design prevent an overly permissive architecture from being corrected too late.
Backups are not enough if their restoration is never tested. Likewise, logs are useless if they can be modified by the compromised account or if no one knows how to use them. The security of data processed by a subcontractor must be tested in concrete scenarios, including the loss of an administrator account and the service provider’s unavailability.
Framing the outsourcing arrangement before development avoids many contractual and technical surprises. An outside perspective can, in particular, bring the contract, architecture, and crisis procedure into alignment—three topics too often handled separately.
FAQ on the security of data entrusted to a service provider
Is a hosting provider a data processor within the meaning of the GDPR?
A hosting provider is generally a processor when it stores or processes personal data on behalf of the company. Its role, security measures, and its own service providers must also be governed in accordance with Article 28 of the 2016 GDPR.
Can a service provider be prohibited from using other companies?
The contract may regulate the use of subsequent subcontractors through specific or general prior authorization, in accordance with Article 28 of the 2016 GDPR. Equivalent data protection obligations must be imposed on them.
Does the 72-hour period begin after the attack?
The 72-hour deadline concerns, where notification is required, the time when the data controller becomes aware of the breach, and not necessarily the technical date of the attack. Since 2018, the CNIL has clarified that an initial notification may be supplemented if all the information is not yet available.
Does certification exempt you from auditing a service provider?
A certification can help demonstrate safeguards, but it does not replace an assessment of the service actually being used. In 2024, the CNIL recommended verifying the measures through audits or inspections and, in particular, examining access controls, encryption, logs, and administration.