Gîtes de France: 389,000 customers' bookings in a data leak

On 17 May 2026, Gîtes de France — a historic player in French rural tourism and vacation rentals — disclosed a large data leak affecting the booking records of 389,129 customers. The breach surfaced as part of a wave of attacks on the French tourism sector, with Pierre & Vacances–Center Parcs and Belambra disclosing incidents on the same weekend.

The compromise stemmed from fraudulent access to reservation data held by departmental structures that share the same IT service provider. A threat actor using the handle "ChimeraZ" — previously linked to a breach at Maeva — claimed responsibility and said the stolen archive (around 470 MB of JSON) spanned booking history reaching back as far as 1995.

The exposed data included:

• Customer names and first names
• Email addresses and phone numbers
• Complete postal addresses
• Travel dates, stay duration and number of occupants
• Stay taxes and reservation amounts
• Internal logs and technical support tickets (about 69,838 lines)

The network stated that no banking or payment data was compromised. In response, Gîtes de France implemented additional security measures, said it would file a criminal complaint against persons unknown, and began notifying affected customers from 18 May 2026. The exposed details create a heightened risk of phishing, tourism-fraud schemes, identity theft and — given the booking dates — the ability to identify when homes are unoccupied.