813,866 users affected by the data leak at Medoucine

On 12 March 2026, Medoucine — a French online platform that connects patients with alternative-medicine practitioners (naturopathy, hypnosis, sophrology, reiki, meditation) — confirmed a data breach after a cybercriminal advertised a database of its users for sale on a dark web forum. The company acknowledged the incident the same day.

The leaked database covered 813,866 users, including roughly 6,500 practitioners. Researchers counted 653,982 unique email addresses and 804,983 unique phone numbers, among them around 70 government (.gouv.fr) addresses. Medoucine said the intrusion stemmed from a security vulnerability in its systems that was exploited to extract user records.

Exposed data categories were:

• Names and given names
• Email addresses
• Phone numbers
• Consultation/reservation history (number of appointments completed)

Medoucine stated that appointment details such as consultation reasons and practice types, as well as account passwords, were not affected. Because the records tie individuals to wellness consultations, the main risk is highly targeted phishing in which attackers impersonate Medoucine, a practitioner or a health insurer.

In response, Medoucine said it identified and corrected the vulnerability, blocked the unauthorized access, notified France's data protection authority (the CNIL), filed a complaint with the competent authorities, and advised users to change their passwords and adopt security best practices.