Leak at Résidence du Parc (Champdeniers-Saint-Denis)

On 10 December 2025, EHPAD Résidence du Parc — a roughly 90-bed nursing home in Champdeniers-Saint-Denis, Deux-Sèvres — disclosed a ransomware attack that struck its information systems during the week of 8 December. Attackers encrypted files across the facility's network and left a text-file ransom note in every affected folder demanding 5 million dollars. Several internal systems were knocked offline.

Management stated that the quality of care for residents was not affected, but that the damage to the IT environment was significant. According to the director, residents' medical records, accounting data and HR/payroll files were held in a separate computer system and were not compromised. The breach instead affected administrative and tracking files, with a risk of data exfiltration that prompted warnings to families about phishing and identity-theft attempts.

Data potentially exposed included:

• Administrative management and daily tracking spreadsheets
• Payroll-monitoring data
• Correspondence with the Regional Health Agency (Excel/Word documents)
• Possibly identity documents scanned during resident intake

The facility filed a criminal complaint and activated an internal crisis cell. It notified the French data-protection authority (CNIL), the Regional Health Agency (ARS) and the national cybersecurity agency (ANSSI), and set up an information hotline for affected families. The investigation was ongoing at the time of disclosure, with the responsible group not publicly identified.