ENKR

Viamedis and Almerys health third-party payment data breach

Add to my breach check

Made public · 33,000,000 people, both operators combined

What leaked4

Hard to replace

  • Other profile data

Permanent

  • National ID or tax number
  • Date of birth
  • Full name
  • National ID or tax numberFrench social security number
  • Full namecivil status
  • Other profile dataname of the health insurer and the cover of the contract

To-dos

None of the harms this check covers.

What happened next10 events

  1. UndetectedNone on record
  2. Response 7 eventsNo individual notice on record · show events
  3. RemedyNone on record
  4. Penalty 3 eventsOngoing · show events
  5. DisputesNone on record
  1. An online complaint-letter form was opened so affected people could file a complaint without going to a police station
  2. Preliminary criminal investigation opened · attacks on data processing systems, fraudulent collection of personal data, handling stolen goods, assigned to the cybercrime brigade
  3. CNIL opened investigations into the security measures in place before and after the incident
  4. CNIL put the breach at more than 33 million people: civil status, date of birth, social security number, insurer name and contract cover
  5. Almerys closed its portal for health professionals; its tiers payant (direct billing) services kept running
5 more
  1. Almerys announced a cyberattack using stolen logins of health professionals; bank, medical, contact and address data not affected
  2. Both operators informed the CNIL of the attack they suffered at the end of January
  3. Both operators filed complaints with the public prosecutor
  4. Viamedis's website was taken offline
  5. Viamedis announced that an attacker had got into its systems two days earlier
Company
Viamedis
When it happened
Made public
Notice
Leak confirmed
Affected
33,000,000 people, both operators combined · more than 33 million insured people and their families; CNIL

How the facts developed

  1. Two third-party payment operators were attacked days apart with a similar method (stolen health-professional logins); CNIL counted more than 33 million people and opened an investigation; bank, medical, contact and address data reported as not affected

Sources