{"id":"cegedim-french-patient-data-breach-feb-2026","category":"breach","status":"closed","title":"Cegedim patient-data breach reportedly affects around 15 million people in France","tldr":"A breach of Cegedim’s medical-practice service exposed French patients’ identity and contact details, with sensitive notes in some records. Around 15 million people were reportedly affected. Ask your GP whether your records were involved.","summary":"Cegedim Santé confirmed that patient information held through 1,500 doctors’ accounts in MonLogicielMedical.com was illegally accessed or extracted. It detected the incident in late 2025 and publicly addressed it on 26 February 2026 after a France 2 investigation. Exposed information included names, dates of birth, addresses, phone numbers, email addresses and free-text administrative comments. Cegedim said some comments contained sensitive information and that structured medical records remained intact. The health ministry put the impact at around 15 million patients, including approximately 169,000 potentially affected by sensitive notes; the CNIL could not confirm the overall total. Cegedim said it contained the incident and contacted affected doctors, offering help with patient notifications. As at 3 November, the sources checked provide no later confirmation of completed patient notification, recovery or deletion of stolen data, or charges.","action":"If you receive care in France, ask your GP whether your records were affected. Verify unexpected messages mentioning your health by calling the practice on a known number before sharing personal information or paying.","product":"Cegedim Santé MonLogicielMedical.com (MLM)","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["cegedim","france","healthcare","data-breach","patient-data"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Statement regarding the report broadcast during France 2 TV's 8 p.m. news program on February 26, 2026","url":"https://www.cegedim.com/Communique/Cegedim_PressRelease260226_ENG.pdf","by":"Cegedim","date":"2026-02-26"},{"kind":"news","title":"French political figures among millions affected by massive health data leak","url":"https://www.brusselstimes.com/news/1995423/france-political-figures-among-millions-affected-by-massive-medical-data-leak/","by":"The Brussels Times","date":"2026-02-27"},{"kind":"news","title":"Cyberattaque dans la santé : la Cnil ne confirme pas «à ce stade» le nombre de personnes touchées","url":"https://www.europe1.fr/sante/cyberattaque-dans-la-sante-la-cnil-ne-confirme-pas-a-ce-stade-le-nombre-de-personnes-touchees-905439","by":"Europe 1 with AFP","date":"2026-02-27"}],"started":"2026-02-26","closed":"2026-02-27","created":"2026-11-03T20:16:03.453Z","updated":"2026-11-03T20:16:03.453Z","cve_notes":[],"timeline":[{"at":"2026-02-27","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"The CNIL told AFP it could not yet confirm the reported number of affected people. It said notifications received the previous autumn described a scale that differed from the figures reported publicly.","url":"https://www.europe1.fr/sante/cyberattaque-dans-la-sante-la-cnil-ne-confirme-pas-a-ce-stade-le-nombre-de-personnes-touchees-905439","by":"Europe 1 with AFP","patch":null},{"at":"2026-02-27","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"The Brussels Times reported the French health ministry's estimate of around 15 million affected patients, including approximately 169,000 whose records could contain sensitive free-text notes. The health minister requested an explanation of the causes and corrective measures.","url":"https://www.brusselstimes.com/news/1995423/france-political-figures-among-millions-affected-by-massive-medical-data-leak/","by":"The Brussels Times","patch":null},{"at":"2026-02-26","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"France 2 revealed the breach. Cegedim said it had detected and contained the incident in late 2025, contacted affected doctors in early January, notified the CNIL and filed a criminal complaint.","url":"https://www.cegedim.com/Communique/Cegedim_PressRelease260226_ENG.pdf","by":"Cegedim","patch":"na"}],"url":"https://hard.fyi/live/cegedim-french-patient-data-breach-feb-2026/","json":"https://hard.fyi/api/live?id=cegedim-french-patient-data-breach-feb-2026"}