Leak at APRS (via Itelis)

On 24 November 2025, APRS — a French health insurer (mutuelle/OCAM) — informed members that their personal data had been exposed through a breach at Itelis, the third-party optical and health-care provider network operated for AXA that manages optical reimbursement claims. APRS was one of several insurers and mutuelles caught up in the incident, alongside AXA, Malakoff Humanis and AG2R.

The breach did not stem from APRS's own systems. Attackers gained unauthorised access to the Itelis reimbursement platform by impersonating a legitimate partner optician, using compromised credentials rather than directly breaching a database. The exposed records covered optical-care claims processed roughly between 2020 and early 2022.

Data reported as exposed included:

• Name and first name
• Date of birth
• Social security number
• Claim/dossier number and optical reimbursement records
• Vision-correction data
• Phone number (in some cases)

Itelis stated that banking details, postal addresses, email addresses, usernames and passwords were not affected. The exact number of impacted individuals was not disclosed by Itelis or APRS. Itelis took its platform offline, notified the CNIL and filed a criminal complaint, while AXA warned affected customers to be alert to phishing attempts that could exploit the leaked data.