Marital status, social security number: the data of 33 million French people hacked, the Paris prosecutor's office opens an investigation

Max Bender/Unsplash Cyberattacks are more and more recurrent. According to Dell's Global Data Protection Index survey, more than 54% of businesses worldwide have been targeted.

TECH – The data of more than 33 million people was hacked at the end of January 2024. Two successive cyberattacks targeted service providers Viamedis and Almerys, specialized in third-party payment management for many complementary health and mutual insurance companies. According to the National Commission for Information Technology and Liberties (CNIL), victims' personal data such as marital status or social security number were compromised, unlike banking or medical information. The Paris public prosecutor's office has announced the opening of an investigation and the people concerned can file a complaint.

The announcement was made by the CNIL, which was informed by Viamedis and Almerys of the cyberattacks which they were victims at the end of January.

The Paris prosecutor's office opens an investigation

The CNIL gave more details a week later, on February 7. The data leak concerns more than 33 million people in France. The latter were to be informed of this hacking by complementary health insurance customers of Viamedis and Almerys. “The data concerned are, for the insured and their family, the marital status, the date of birth and the social security number, the name of the health insurer as well as the guarantees of the contract subscribed”, it is revealed in a press release.

The Commission for Information Technology and Liberties adds that “data such as banking information, medical data, health reimbursements, postal details, telephone numbers or even emails would not be affected by the violation”. CNIL says it is continuing its investigation aimed at determining “whether the security measures implemented prior to the incident and in response to it were appropriate with regard to the obligations of the General Data Protection Regulations”. advised to exercise caution and periodically check the activities and movements on their various accounts. Leaked information may also be the subject of phishing or unusual movements on different accounts.

The general director of Viamedis, Christophe Candé, spoke of an intrusion into the platform: “The account of a healthcare professional was phished.” A complaint was filed with the public prosecutor. For its part, Almerys explained that the hackers were able to “suction the display pages” of insured customers, using a bot (a robot, Editor’s note). The operator’s information system “did not suffer any intrusion” and the cyberattack was carried out from “two identified IP addresses”.

The Paris prosecutor's office announced on February 9 that it had opened an investigation. The investigations were entrusted to the judicial police's anti-cybercrime brigade and relate to the offenses of breach of an automated data system, fraudulent collection of personal data and receiving stolen property.

Cyberattacks: inevitable?

In the meantime, healthcare professionals are directly affected. “We suffered a suspension of payments via Viamedis,” testifies Valérian Ponsinet, president of a commission on digital systems within the Federation of Pharmaceutical Unions of France (FSPF). The situation of opticians is the most complicated. “Viamedis has not communicated to us any date for the restoration of their service. We learned through the press that they had been hacked”, explains Hugues Verdier-Davioud, president of the National Federation of Opticians of France (FNOF), which recalls that its colleagues are also experiencing “consequences in terms of cash flow” and that they are “awaiting liquidation of files”.

The optician drives the point home by recalling that he has already warned against “a flow security problem”. “Our federation has been contacting the CNIL for years to take note of the failures that exist in the processing of flows between opticians and complementary health insurance companies.” According to him, numerous data collected are not always essential to the operation of operators “They do not need as much detail, especially since some are subject to medical confidentiality”, he affirms.

The scale of this cyberattack is unprecedented. Although this leak did not concern sensitive banking or medical information this time, it is a reminder of the vulnerability of information systems, however secure they may be.

Cyberattacks are increasingly recurrent and according to the Global Data Protection Index (GDPI) survey by Dell, one of the largest computer manufacturers, more than 54% of companies around the world have been targeted. In France, around thirty local authorities as well as nine hospitals have been victims of cyberattacks.

These occur at a time when, in Europe, the project of a digital euro, supported by the European Central Bank (BCE), is currently being finalized. The dematerialized version of the single currency will not be “totally anonymous” according to a recent statement by Christine Lagarde, President of the ECB, and a flaw would quickly compromise the security of the data recovered by banking establishments. /p>