Leak at Médecin Direct

On 3 December 2025, MédecinDirect — a French teleconsultation platform and a subsidiary of the US group Teladoc Health — notified patients of a data breach affecting their personal and health information. The company said it had detected a computer intrusion on 28 November 2025 and stopped it on detection; affected users were informed on 3 December.

The breach exposed a mix of identity and sensitive medical data. According to MédecinDirect, the compromised information included:

• First and last name, date of birth, postal and email address
• Some social security (NIR) numbers
• The subject of the teleconsultation and pre-consultation questionnaire responses
• Written exchanges between patients and practitioners

The company stressed that teleconsultation videos were not affected, as they are not recorded. MédecinDirect officially notified around 285,000 people, while a threat actor offering the data on the criminal market claimed up to 323,069 patient records.

MédecinDirect alerted France's data protection authority (CNIL) on 28 November and filed a complaint with the Paris public prosecutor. The company said its services continued to operate normally, that it had reinforced its monitoring and protection measures, and that an investigation into the origin of the incident was underway.