French Medical Data Breach: 15 Million Records Hacked, Key Details

A massive data breach has compromised 15 million French medical records, raising serious concerns over patient privacy. Authorities are now investigating which sensitive personal and health information was exposed in one of France’s largest healthcare cyberattacks.

Vast Data Breach Hits French Health Sector

A sweeping cyberattack has rocked the French healthcare system, after the widely used medical management software developed by Cegedim Santé suffered a breach exposing the administrative information of around 15 million citizens. According to figures shared by the Ministry of Health, this is being described as an unprecedented incident in France’s digital health landscape, with repercussions likely to last for years.

Sensitive Data Beyond Names and Numbers

While early statements sought to reassure the public that no structured medical records, prescriptions, or lab results had been accessed, the situation is far from benign. For approximately 169,000 patients, hackers gained access to free-text notes entered by their physicians—sometimes revealing highly sensitive details such as sexual orientation or diagnoses like HIV. Investigative reporting by France 2 even points to data involving several political figures. The breach encompasses “19 million digital lines” and covers up to fifteen years of historical entries, depending on each clinic’s system.

Accountability and Ongoing Investigation

Immediate action followed the disclosure: authorities instructed Cegedim Santé, a leading handler of French medical data, to implement corrective measures without delay. A formal complaint was filed on October 27, 2025, launching a criminal probe for “breaches of an automated data system.” Interestingly, company representatives insist that only administrative fields and open comments—not structured clinical files—were exposed.

Several factors explain this rapidly escalating crisis:

• Cegedim Santé faced an €800,000 fine in September 2024 for previous unauthorized health data processing.
• The hacking group known as DumpSec is suspected but remains unidentified.
• Wavestone‘s expert Gérôme Billois warned this could be “the largest leak in French healthcare history,” with potentially irreversible consequences.

Structural Weaknesses Laid Bare

Uncertainty clouds the full scale of harm caused by this breach. France’s data watchdog, the Cnil, has announced a thorough review and may conduct further audits. Chronic underinvestment in healthcare cybersecurity now stands exposed—an issue cited as contributing to the sector’s vulnerability. Amidst mounting anxiety among both patients and doctors about the safety of their personal health data, questions linger over whether existing safeguards are anywhere near robust enough for today’s threats.