Leak at ASAF & AFPS (via Itelis)

On 5 December 2025, ASAF & AFPS — a French member-based insurance association — notified members that their personal data had been exposed in a breach at Itelis, the optical-care network that processes optical reimbursement claims on the association's behalf. Because the data was held and processed by this third-party partner, the incident is a supply-chain compromise affecting ASAF & AFPS members rather than a breach of the insurer's own systems.

The unauthorised access was tied to the impersonation of a partner optician account, allowing the attacker to reach claim data without compromising policyholder credentials. The exposure was limited to optical-care claims processed between 2020 and the first quarter of 2022. Itelis also processes claims for other clients, including Axa and Malakoff Humanis, whose insured were affected as well.

Exposed data included:

• Full name and date of birth
• Social security number
• Claim/file reference number
• Optical reimbursement record
• Vision-correction data
• Phone number (in some cases)

Banking details, postal addresses, email addresses and passwords were reported as not affected. Itelis notified the CNIL, filed a complaint with the public prosecutor and activated a crisis team. ASAF & AFPS warned members to watch for phishing and fraud attempts leveraging the exposed information and offered personalised follow-up for any reported fraudulent activity. The exact number of affected individuals has not been publicly disclosed.