Massive data breach affects 33 million French citizens: Viamedis and Almerys targeted

Viamedis and Almerys, two key operators managing third-party payments for supplementary health insurance in France, have reported a cyberattack to the French data protection authority, CNIL. The breach occurred at the end of January and impacted approximately 33 million individuals, making it the most significant cyberattack in French history.

The compromised data, including social security numbers, civil status, date of birth, health insurer’s details, and policy coverage for insured individuals and their families, poses significant privacy concerns.

Although banking information, medical records, and contact details remain unaffected, the stolen data is highly sensitive and exposes victims to potential phishing and identity theft risks.

The cyberattack, believed to have stemmed from the theft of credentials and passwords of healthcare professionals, was detected by Viamedis on February 1st, prompting alerts to other third-party payment platforms. Almerys also confirmed an intrusion shortly after.

With both service providers collectively overseeing nearly 40 million Social Security-insured individuals and collaborating with numerous supplementary health insurers and professional members, the breach underscores the extensive reach and impact of the incident.

As investigations continue to determine the root cause and perpetrators of the breach, concerns persist regarding the potential misuse of stolen data. The CNIL warns of the possibility of combining compromised data with information from previous breaches, heightening the risk of identity theft and fraudulent activities.

The compromised social security numbers, serving as unique identifiers for French citizens, highlight the gravity of the situation, as they are integral to various administrative procedures and cannot be easily changed like passwords.

Authorities and affected parties remain vigilant as efforts are underway to mitigate the consequences of one of France’s largest data breaches, emphasizing the urgent need for enhanced cybersecurity measures and data protection protocols in the healthcare sector.