113,000 members affected by a cyberattack at La Mutuelle Familiale

On 20 March 2026, La Mutuelle Familiale — a French complementary health insurer (mutuelle) managed within the Umanens group — disclosed a cybersecurity incident, an unauthorized intrusion into its information systems that had been detected on 17 March 2026. Around 113,000 members were potentially affected.

The intrusion forced the mutuelle to suspend several services while it investigated, including reimbursements, third-party-payment processing, the telephone platform, the member portal and the mobile app. Initial analyses could not immediately establish the full scope of compromised data, but the organisation later confirmed that personal data of members had been exfiltrated and, on 24 April 2026, sent postal notification letters to those affected.

Exposed data categories included:

• Identity documents (ID cards) and personal identifiers (names, dates and places of birth)
• Bank details (RIB) and administrative documents
• Contact information and family composition
• Health and insurance/claims data

La Mutuelle Familiale filed a criminal complaint and made the required legal notifications to France's data-protection regulator (CNIL) and the insurance supervisor (ACPR). It urged members to stay alert to phishing attempts by email, SMS and phone that could exploit the leaked data. Services, including the member portal and mobile app, were progressively restored by May 2026, with members required to reset their passwords on reopening.