Leak at Inovie Labosud

On 23 September 2025, Inovie Labosud — a major medical-analysis laboratory group based in southern France — disclosed that attackers had gained unauthorized access to patient personal data. A police source cited in French media estimated that around 3.2 million patients were affected, including roughly one million whose records contained medical information on pathologies, treatments or medical documents.

The intrusion was traced back to 31 August 2025, when the laboratory detected abnormal server saturation and the execution of scripts connecting to its network. The attackers gained entry using compromised credentials (username and password) belonging to one of the group's external service providers — a relatively simple foothold that allowed lateral access across the network.

The exposed data fell into two categories:

• Administrative data: identity, contact details, social security and supplementary health-insurance (mutuelle) information
• Medical data: information relating to the characteristics of laboratory tests performed

According to the company, no passwords or banking data were affected. Inovie Labosud said it took immediate measures to block the unauthorized access and contain the breach, notified the CNIL, ARS Occitanie and ANSSI, and filed a criminal complaint to open a judicial investigation. Patients were warned to stay alert for phishing attempts that could exploit the leaked information.