The private data of nearly half of the French citizens has been leaked due to a massive security breach of two healthcare payment service providers, as reported last week by the French data privacy regulatory body.
The National Commission for Informatics and Liberties (CNIL) has revealed that the payment companies Viamedis and Almerys suffered separate breaches of their systems in late January, resulting in the theft of data from over 33 million customers. The affected data on customers and their families includes dates of birth, marital status, social security numbers, and insurance information. CNIL added that no banking, medical, or contact information has been compromised.
“This is the first time such a violation of this magnitude has occurred [in France],” said Yann Padova, a lawyer specialized in digital data protection and former Secretary General of the CNIL, to the French radio station Franceinfo. Padova believes that the violation is the largest in the history of France.
Viamedis would have been compromised through a targeted phishing attack on healthcare professionals, which used stolen credentials from these professionals to access their systems. Almerys has not disclosed how the cyberattack occurred, but admitted that the attacker gained access through a portal used by healthcare professionals, so it is possible that it was of a similar nature.
