CARMF: 2.4 million doctor records leaked after a cyberattack

On 12 May 2026, CARMF — the Caisse Autonome de Retraite des Médecins de France, the mandatory pension and benefits fund for self-employed physicians in France — was named in a cybercriminal forum post by an actor using the alias lazasec, who claimed to have compromised CARMF's systems and exfiltrated a database of nearly 2.4 million records relating to French doctors and contributors.

The attacker published a sample to support the claim. The exact intrusion vector has not been confirmed publicly, and the full authenticity of the leaked database remains unverified. The sample exposed administrative and declarative fields rather than clinical or financial records:

• First and last names
• Contributor (cotisant) codes
• Postal code and city
• Date of last declaration

CARMF disclosed the security incident itself the following day, on 13 May 2026, via its newsletter, describing the leak as "limited" and characterising the affected information as public and non-sensitive. The fund reported that roughly 70,000 affiliates were concerned, a figure substantially lower than the 2.4 million records advertised by the attacker.

While the exposed fields are not medical records, the leak of physician identity and contact details raises the risk of targeted phishing and social-engineering attacks against doctors and the wider French healthcare sector. The incident appears contained, but the origin of the compromise had not been publicly established at the time of reporting.