Leak at Almerys, Viamedis

On 6 February 2024, Viamedis and Almerys — two French operators that manage tiers payant (third-party payment) for supplementary health insurers — disclosed data breaches that together exposed information on roughly 33 million people, around half of the French population. France's data protection authority, the CNIL, confirmed the scale, making it one of the largest data breaches in the country's history.

The attackers did not break the companies' core systems directly. Instead they targeted the accounts of healthcare professionals that have legitimate access to the Viamedis and Almerys portals, most likely via phishing or by reusing credentials stolen in earlier breaches. Viamedis detected the intrusion in late January 2024 and Almerys reported a similar compromise of professional accounts on 5 February.

The exposed data covered policyholders and their families and included:

• First and last name
• Date of birth
• Marital and civil status
• Social security number
• Name of the health insurer
• Type of contract and guarantees open to third-party payment

Both operators stated that no banking details, email or postal addresses, or telephone numbers were exposed, as these are not stored on the affected systems.

The companies cut off the compromised access and notified affected insurers, who in turn warned their members. The CNIL opened an investigation to assess the security measures in place and whether the operators met their GDPR obligations, while warning of an elevated risk of phishing and identity fraud given the breadth of the leaked identity and insurance data.