Breach affects half of France

French regulators recently warned that a January 2024 cyber-attack on two major healthcare sector companies caused over 33 million people’s data to be compromised. The data includes sensitive personal information, which threat actors could exploit in phishing campaigns and financial fraud schemes. Cybersixgill observed demand for the stolen data on the underground, in addition to threat actors disseminating similar content from previous breaches.

On February 7, 2024, France’s National Commission for Information Technology and Liberties (CNIL) issued a notice that two major healthcare payment service providers, Viamedis and Almerys, suffered cyber-attacks that affected the data of more than 33 million people. CNIL noted that the attack took place at the end of January 2024, with the compromised data relating to policyholders and their family members.

The data includes marital status, dates of birth, national identity numbers, and health insurance carrier names, among other information. While the CNIL notice indicated that the breach did not affect banking information, medical data, physical addresses, telephone numbers, or emails, threat actors could use the data that was compromised for a variety of malicious activities. These include phishing attacks, identity theft, and financial fraud.