In May 2026, Gîtes de France, a French holiday rental network, was hit by a data breach impacting several of its departmental branches. The exposed data included roughly 118,000 unique email addresses together with customer names, phone numbers, postal addresses and booking details.
While no passwords were reported in this dataset, the combination of email addresses with rich personal and contextual booking information provides fertile ground for targeted phishing and social engineering. Attackers can use these verified identities and travel details to craft convincing lures aimed at harvesting credentials or account access.
What to take away: Even breaches without leaked passwords feed credential-attack pipelines. Organizations should monitor exposed employee and customer emails against breach corpora, enforce MFA, and remain alert to phishing campaigns that leverage leaked PII for identity compromise.