Medical data of 500,000 put online in France cyber attack

Hackers published stolen information including names, contact details, social security numbers, and medical history 

24 February 2021
By Joanna York

Confidential medical data from almost 500,000 people in France has been stolen and released online, it was revealed yesterday.

Sensitive information, including the names and contact details (such as phone numbers, postcodes and addresses) of 491,840 people in France have been released, an investigation by news source Libération and cyber-security blog Zataz found.

Identifying information was sometimes accompanied by details of people’s blood group, social security number, birth date, GP, health insurance provider, medical treatments, illnesses (including instances of HIV) and health updates including confirmation of pregnancies.

Data now available online

The data, covering a period from 2015-October 2020, was reportedly stolen from around 30 medical laboratories in north west France.

Damien Bancal, the Zatav journalist who uncovered the story on February 14, told AFP: “You can already find the files in seven different places online.”

He said hackers that specialise in sharing stolen data had been in possession of the files and were intending to sell the information, until it was released publicly by one hacker after a disagreement. 

He said: “500,000 data points is already huge, and we have no reason to doubt that the hackers have many more in their possession.” 

Software provider investigating

All of the laboratories that had data stolen were using software created by the specialist healthcare provider Dedalus. 

Didier Neyrat, chief operating officer at Dedalus France, told the Agence France-Presse: “We are not certain that the sole reason for this incident was Dedalus software.”

But, he added: “We have set up a crisis cell group as we are taking this seriously, and we will work in partnership with our clients to understand what has happened.” 

National digital security agencies l'Agence nationale des systèmes d'information and le gendarme des données personnelles, and health body la direction générale de la santé, are yet to comment on the incident. 

One of multiple incidents this year 

This is not the first breach of digital security concerning French health organisations in the past year. 

On February 19, 2021, the health ministry said that confidential data concerning 50,000 doctors and medical staff in France was being sold in an online cybercrime forum, including usernames and passwords.

And Cédric O, junior minister for digital affairs, said last week “there have been 27 cyberattacks on hospitals in 2020 and since the beginning of 2021”.

Two attacks on hospitals in Dax and Villefranche-sur-Saône on February 8 and 15, 2021, completely disabled internal systems.

Read more: France to invest €1bn in cybersecurity as hospitals targeted 

Bug blamed for banking app malfunction

It comes as the LCL bank has confirmed that a bug, rather than a cyberattack, was responsible for issues with its banking app, which affected hundreds of clients yesterday evening.

The bug, which occurred during an update of the app, meant that some clients who accessed the app between 17:40-18:40 were able to see banking details for other clients, rather than their own.

The bank said in a letter to AFP that the information did not allow clients to identify people whose data was revealed.

But one user wrote on Twitter: “I am shocked. Connecting to the LCL app I have access to someone else’s accounts – Caroline - [I can see] what she has spent, all of her accounts, how much she has saved… what is happening with your security LCL?” 

The user said that after logging out of the app, completing an update and logging back in, the app returned to normal. But she said: “I don’t want anyone to have access to my accounts. Even for 10 minutes.”

The bank said that while 72,000 clients used the app in the affected time frame, “the incident only affected a few hundred people”.

It added: “In no case was it possible to complete transactions from accounts which were incorrectly shown, nor to access information about account holders.”

Related stories

France: 4-fold rise in online shopping scams last month

Resident or second-home owner in France?
Benefit from our daily digest of headlines and how-to's to help you make the most of life in France
By joining the newsletter, you agree to our Terms & Conditions and Privacy Policy
See more popular articles
The Connexion Help Guides
Income Tax in France 2021 (for 2020 income)*
Featured Help Guide
Order your Income Tax in France guide now for immediate digital access
Get news, views and information from France
You have 2 free subscriber articles left
Subscribe now to read unlimited articles and exclusive content
Already a subscriber? Log in now