Quote:On February 26, 2026, a revelation sent shockwaves through the French healthcare system: a massive data breach linked to the Cegedim Group was made public, potentially compromising the personal information of millions of patients and the notes written by their doctors. Here is a detailed and structured account of the known facts, compiled by me.
Cegedim is a French company founded in 1969, specializing in software and digital services for the healthcare sector. It develops solutions used by doctors, laboratories, and insurers to manage patient records, billing, and medical data.
The attackers reportedly gained access to several internal or compromised access points. The categories cited include, in particular:
- OWA (Webmail): access to the company’s webmail, which generally corresponds to Outlook Web Access, used by employees to check their work emails.
- VPN: a virtual private network allowing employees or contractors to connect to the company’s internal network remotely.
- Cloud: access to resources hosted in the company’s cloud infrastructure.
- Zendesk (CRM / support): a tool for managing customer support and technical tickets.
- Technician access: likely an internal account used for maintenance or technical support.
The group explains that the user @czx (a BreachForums user) had already sold a small portion of what he possessed via RDP access.
DumpSec listed this data dump for sale on the BreachForums marketplace, and according to them, it reportedly sold for a six-figure sum. The sample provided as evidence contains 300,000 lines and is available below!
Quote:On February 26, 2026, a revelation sent shockwaves through the French healthcare system: a massive data breach linked to the Cegedim Group was made public, potentially compromising the personal information of millions of patients and the notes written by their doctors. Here is a detailed and structured account of the known facts, compiled by me.
Cegedim is a French company founded in 1969, specializing in software and digital services for the healthcare sector. It develops solutions used by doctors, laboratories, and insurers to manage patient records, billing, and medical data.
The attackers reportedly gained access to several internal or compromised access points. The categories cited include, in particular:
- OWA (Webmail): access to the company’s webmail, which generally corresponds to Outlook Web Access, used by employees to check their work emails.
- VPN: a virtual private network allowing employees or contractors to connect to the company’s internal network remotely.
- Cloud: access to resources hosted in the company’s cloud infrastructure.
- Zendesk (CRM / support): a tool for managing customer support and technical tickets.
- Technician access: likely an internal account used for maintenance or technical support.
The group explains that the user @czx (a BreachForums user) had already sold a small portion of what he possessed via RDP access.
DumpSec listed this data dump for sale on the BreachForums marketplace, and according to them, it reportedly sold for a six-figure sum. The sample provided as evidence contains 300,000 lines and is available below!
![[Image: ?u=https%3A%2F%2Fd1dejaj6dcqv24.cloudfro...b436b816be]](https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Fd1dejaj6dcqv24.cloudfront.net%2Fasset%2Fimage%2Flogo%2Fcegedim-480.png&f=1&nofb=1&ipt=fa53c025d07e86083ba5d33a5905a2bee96bab62ddd80c3d08fa87b436b816be)