Leak at Alan (via Almerys)

On 23 May 2026, Alan — a French digital health insurer ("mutuelle") — notified its members that their personal data had been exposed in a cyberattack on Almerys, the third-party tiers-payant (claims) processor that handles reimbursements between insured members, healthcare providers and insurers. Alan's own systems were not breached; the data leaked through its provider.

The intrusion stemmed from the fraudulent compromise of a healthcare professional's account on Almerys' prise-en-charge platform, which is used to authorise audio, optical and hospital care. The threat actor (using the handle "Lagui") advertised a database of roughly 44 million records containing about 15.4 million unique social security numbers, making it one of the largest French health-data leaks in recent years and affecting members across many insurers, not only Alan.

The exposed data for affected Alan members included:

• First name, last name and date of birth
• Birth order (rang de naissance)
• Social security number
• Insurance contract number and insurer name
• Coverage start and end dates

Alan stated that payment/banking details, passwords and health (medical) data were not affected. The insurer notified the ACPR (insurance regulator) and the CNIL, took the position that its platform remained intact, and urged members to stay vigilant against phishing attempts that could exploit the leaked identity data. Almerys took its reimbursement platform offline on detecting the attack and filed an initial CNIL notification on 25 May 2026. This was Almerys' second major data incident in roughly two years, following the 2024 Viamedis/Almerys breaches.