Leak at Itelis

On 25 November 2025, Itelis — a French health-care network platform that connects opticians with insurers (notably AXA) to manage optical-care coverage — publicly disclosed a cyberattack that exposed the personal data of beneficiaries enrolled in its reimbursement programmes.

The intrusion was carried out around mid-November 2025 (the platform was taken offline after an incident on 12 November) and did not rely on malware or a classic backdoor. Instead, attackers reportedly used identity usurpation to gain access to the system, then exfiltrated personal data tied to optical care provided between 2020 and the first quarter of 2022. Roughly 1.6 million beneficiaries are believed to be affected; the higher "5 million" figure circulated in early reports referred to raw records rather than confirmed individuals.

The exposed data covered identity and health-administrative fields:

• First and last name
• Date of birth
• Social security number (NIR)
• File/dossier number
• Optical correction data and reimbursement details
• Potentially phone numbers

Banking details, postal and email addresses, and login credentials (usernames and passwords) were not affected. Itelis notified the CNIL, filed a criminal complaint with the public prosecutor, and warned affected individuals to stay alert to phishing campaigns seeking to harvest additional personal or financial information.