Cegedim Santé Breach Exposes 15.8 Million French Healthcare Records Including HIV Status

15.8 Million French Patient Records Stolen in Healthcare Software Breach

Cegedim Santé, a major French healthcare software vendor, confirmed that attackers exfiltrated approximately 15.8 million administrative medical files after compromising its MonLogicielMedical (MLM) platform — software used by 3,800 doctors across France. The breach included highly sensitive medical information such as HIV/AIDS diagnoses and sexual orientation data.

What Was Exposed

The breach compromised Cegedim's MonLogicielMedical (MLM) software through abnormal application requests on doctors' accounts. The stolen data includes:

• Personal identifiers — full names, gender, dates of birth, phone numbers, residential addresses, and email IDs
• Administrative records — 15.8 million files covering patient registration and appointment data
• Clinical notes — approximately 165,000 files containing doctors' handwritten notes, which in some cases included:
  • HIV/AIDS status
  • Sexual orientation
  • Mental health diagnoses
  • Substance use details

High-Profile Victims

French media reported that top politicians were among the individuals whose information was extracted, adding a political dimension to what is already France's largest healthcare data breach.

Timeline of Events

1. Late 2025 — Cegedim Santé detects abnormal application requests on doctor accounts
2. January 2026 — All affected doctors and patients notified
3. February-March 2026 — Investigation reveals full scope: 15.8 million records across 1,500 doctor practices
4. March 2026 — Additional security measures implemented; CNIL investigation ongoing

Recommendations

For Affected Patients

• Monitor for phishing attempts referencing your doctor or medical practice
• Request a copy of your data from your healthcare provider under GDPR rights
• Be alert for insurance fraud or identity theft using medical information
• Contact CNIL if you believe your sensitive medical data was exposed

For Healthcare Organizations

• Implement anomaly detection on application-level requests to patient data
• Encrypt sensitive clinical notes at rest with per-record keys
• Segment administrative and clinical data with different access controls
• Conduct regular third-party security audits of SaaS healthcare platforms

Key Takeaways

1. 15.8 million records make this France's largest healthcare breach — affecting roughly one in four French citizens
2. HIV/AIDS status and sexual orientation were among the most sensitive data exposed, creating risks of discrimination
3. 165,000 clinical notes with detailed medical histories were stolen — far beyond basic PII
4. Politicians are among the identified victims, adding national security dimensions
5. The breach went undetected for months before abnormal API requests triggered investigation
6. Healthcare SaaS vendors remain high-value targets — a single platform compromise exposed data from 1,500 medical practices

Sources

• 15.8M medical records stolen from French health ministry — The Register
• Doctors' records hit by cyberattack: up to 15 million patients in France affected — Connexion France
• Centralized Healthcare System Data Breach Leaks Medical Records — CPO Magazine
• 15M French citizens affected by massive data breach — Anadolu Agency