Atout France Launches 2027 Palace Candidacy Campaign


Atout France lance la campagne de candidature pour la distinction Palace 2027, photo by Atout France

Costa Rica


The Palace distinction, established during the overhaul of the hotel ranking to distinguish the elite among five-star establishments, is about to renew its roster of holders.

The national network currently counts thirty-three certified establishments, after the addition of six new addresses at the beginning of the summer.

This honorary distinction, formerly awarded for a longer period, is now granted for a strict duration of three years by the minister in charge of Tourism, on the conclusive opinion of a specialized attribution commission.

To read: Palace Label: “The aim is to attract ultra-luxury clientele to France”


The historical foundations and objectives of the distinction

The creation of the Palace distinction followed the comprehensive modernization of the French tourist accommodation offer, initiated in 2009.

While the introduction of the fifth star aimed to harmonize French standards with international frameworks for high-end hospitality, it soon became evident that a category of establishments with extraordinary characteristics needed to be singled out.

The Palace distinction was thus designed as a promotional tool to highlight exceptional properties on a global ultra-luxury market that is increasingly competitive.

In order to preserve the rarity of this label, the State implemented in 2024 a structural reform of the attribution criteria.

In addition to reducing the validity of the title to three years, the new provisions increased the operating seniority required before applying and restricted the possibilities of waivers when examining the ranking criteria.


The technical eligibility criteria imposed on applicants

For its file to be processed by Atout France, a candidate hotel must imperatively meet four cumulative eligibility criteria, otherwise the application will be immediately rejected.

The first criterion concerns the length of activity: the establishment must demonstrate at least 24 months of continuous operation for a newly created hotel, or a minimum of 12 months if it is a reopening after total refurbishment that required a long-term closure.

The second criterion requires the candidate to hold a current five-star rating.

The third criterion governs the size of accommodations, requiring a minimum surface area of 26m2, bathrooms included, for each room. An exception to this size rule is tolerated for a maximum of 10% of the hotel’s total room count.

Finally, the fourth criterion requires the validation of all the enhanced criteria of the five-star ranking grid. These options on the general grid become mandatory for Palace eligibility, such as the presence of a spa, a fitness area, a valet service, or a minimum ratio of suites within the hotel, with a tolerance margin limited to a single unvalidated criterion.


The preparation of the application file

The application submission is carried out digitally by creating a personal space on Atout France’s digital platform. The technical dossier to be assembled must by regulation include several supporting documents.

This includes first the official application form properly completed, accompanied by the complete report and the control grid stemming from the latest five-star category inspection. The operator must also attach an official document by which they undertake to cover all costs related to the inspectors’ stay and to provide the corresponding invoices.

The centerpiece of the file consists of a presentation “book,” transmitted in digital format or in two paper copies.

This document aims to demonstrate how the establishment meets the 12 exceptional assessment criteria defined by ministerial decree, such as the building’s history, the aesthetics of the premises, or the legendary character linked to famous personalities. Hotels may supplement this submission with annexed documents illustrating their CSR policy, their commitments to the quality of working conditions, or their internal training plans.


The progression of the evaluation and control procedure

From receipt of the file, the instruction process unfolds in two distinct and eliminatory phases. The first phase is purely administrative: Atout France conducts a technical verification of the four eligibility criteria. If the file is validated, it is then transmitted to the Palace distinction allocation commission.

The second phase rests on a on-site qualitative evaluation. Two members of the allocation commission, experts in the hotel sector and the art of living, carry out inspection visits within the establishment to attest to its exceptional character. Their assessments are based on a subjective “faisceau d’indices” spanning overall aesthetics, the quality of personalized hospitality, the gastronomic offering, and the coherence of the guest experience.

Following these inspection visits, the candidate establishment is summoned for an official audition lasting up to 30 minutes in front of all commission members.

This step allows the hotel’s management to defend its file before the commission proceeds to voting. If the commission’s opinion is favorable, the Palace distinction is formally granted by decree of the minister in charge of Tourism.

Atout France Has Been Hacked: Cyberattack Hits French Tourism Agency


ttt

tttt
Atout France dans la lignée de Belambra, Maeva et Gîtes de France - Depositphotos retouchée par l'IA
ttt

ttt

t

tt

CroisiEurope


tt

tt

tt

tt

ttt

tttt The list is long and shows no signs of stopping.
tttt
tttt
tttt After the historic wave of hacks that hit tourism in May, revealing a relatively basic vulnerability among several major players in the sector, cyberattacks continue in the tourism industry, without ever stopping.
tttt
tttt
tttt And this time, it is the turn of a public institution to have its vulnerabilities laid bare.
tttt
tttt
tttt Atout France therefore suffered an attack by a malicious individual who could have extracted, according to their statements, data from approximately 400,000 user accounts.
tttt
tttt
tttt Samples, as a gesture of good faith, as is customary on the dark web, have been shared.
ttt

tt

tt

t

ttt

ttt

Atout France Following in the Footsteps of Belambra, Maeva, and Gîtes de France

tt

tt

ttt

tttt The hacker claims to have exploited an access-control flaw, i.e., an IDOR (Insecure Direct Object Reference) vulnerability, according to frenchbreaches, as was the case for Belambra, Gîtes de France or Maeva.
tttt
tttt
tttt “In French, one could translate that as having a direct reference to an unsecured object.
tttt
tttt
tttt That is to say that if a profile, a file or an invoice is stored directly within an application, simply entering the direct address could allow access, even without the proper authorization.
tttt
tttt
tttt We are not facing an extraordinarily sophisticated technical exploit, but rather a misunderstanding of security at the human level,
” we were told by Christophe Mazzola, founder of the Cyber Academy, in a previous article.
tttt
tttt
tttt Beyond this weakness, the consequences can be dire for companies or individuals.
tttt
tttt
tttt Regarding Atout France, about 400,000 user accounts would thus be compromised. The attacker(s) would have access to names, first names, roles, emails, phone numbers, billing postal addresses, organizations, member numbers…
tttt
tttt
tttt A multitude of information that could feed, in the future, phishing campaigns or other highly targeted malicious actions. Vigilance will therefore need to be doubled in case of emails purportedly sent by Atout France in the days and months to come.
ttt

tt

tt

t

ttt

ttt

Pacha Tours and Trenitalia France Also Hacked

tt

tt

ttt

tttt Do not believe that, after the historic wave of hacks that the tourism industry experienced, hackers have lost interest in the sector; quite the opposite.
tttt
tttt
tttt Taking advantage, no doubt, of the sector’s cybersecurity weaknesses, the trophies have been many.
tttt
tttt
tttt There was, at the end of June, Pacha Tours. The hackers claimed to have extracted 2 GB of data thanks to “a code-injection technique used to modify or retrieve data in SQL databases (tables with rows and columns, ndlr)“, according to Cloudflare.
tttt
tttt
tttt Thus, on both the Pacha Tours site and its pro space, the compromised data would concern 31,087 unique individuals, 4,413 unique emails, 3,705 unique phones, 132 cleartext passport numbers, 10,153 PNR codes, and 1,096 B2B agency accesses with passwords in clear text, according to the attackers.
tttt
tttt
tttt But that’s not all, because Trenitalia France also suffered a similar misfortune.
tttt
tttt
tttt The malicious actors gained unauthorized access to certain personal data of customers related to ticket purchases. This attack has been confirmed by the operator.
tttt
tttt
tttt An email campaign was sent to the company’s customers.
tttt
tttt
tttt It reveals that the information in the pirates’ possession includes: civil and identification data (buyer and passenger names, passenger date of birth); contact data (email address, phone number); travel data (information associated with the transport ticket, such as itinerary, travel date and time, ticket number); type of offer or service linked to the transport ticket and data needed to benefit from these offers.
tttt
tttt
tttt Moreover, the attackers claim to have extracted data from 60,568 user accounts, as well as metadata from Smartbox agreements or e-signature documents.
tttt
tttt
tttt “We really need to roll up our sleeves and get to work, because this kind of data leak, in Europe, we are truly among the few who know this story.
tttt
tttt
tttt I work a lot in the United Kingdom, Germany, the Netherlands, Luxembourg, Switzerland and Belgium; there, this isn’t as common. France is acting as the delinquent student,
” Christophe Mazzola explained to us.
ttt

tt

tt

t