146,605 patients affected by a claimed leak at SOS Oxygène

On 10 January 2026, SOS Oxygène — a French home-healthcare company specialising in 24/7 respiratory assistance and sleep-disorder therapy — was named in a data-leak claim posted to the BreachForums cybercrime forum.

A threat actor operating under the handle HexDex2 advertised a database said to have been extracted from the provider, distributing samples across several file-hosting services. The tracker entry puts the haul at around 146,605 unique patients, while the forum listing cited roughly 149,110 records — figures that point to the same dataset of patient records. The intrusion vector was not disclosed in the listing.

According to the sample data, the exposed records concerned patient information including:

• Full names
• Postal addresses (street/route, postal code, city), with address identifiers
• Latitude and longitude (GPS) coordinates pinpointing patient locations
• Data-quality indicators

Because SOS Oxygène treats patients with respiratory and sleep conditions, the leak ties named individuals to home addresses and precise geolocation, making the exposure especially sensitive even though no clinical files were referenced in the sample. As of reporting, the breach remained a claim: SOS Oxygène had not publicly confirmed the incident, and the authenticity and full scope of the data had not been independently verified.