French healthcare Viamedis hit by cyberattack, patient data at risk

Viamedis, a French healthcare services firm, has been impacted by a cyberattack, leaving millions of policyholders and healthcare professionals vulnerable to data exposure. Since the company's website being temporarily inaccessible, Viamedis made an announcement on LinkedIn to alert the public about the breach.

The breached data encompasses sensitive information such as beneficiaries:

• marital status,
• dates of birth,
• social security numbers,
• names of their health insurers,
• coverage details pertaining to third-party payments.

Although the exact number of individuals affected remains undetermined, Viamedis is responsible for handling payments for 84 healthcare organizations, which collectively insure up to 20 million people. The firm's General Director, Christophe Cande, emphasized that the investigation is ongoing and that it was a phishing attack targeting an employee that led to the system's compromise, not a ransomware attack.

Update - This data breach affects approximately 33 million people.

Fortunately, the firm confirmed that critical personal information, including banking details, postal addresses, phone numbers, and email addresses, was not compromised during the breach.

Viamedis has taken several measures following the breach, including notifying impacted health organizations, filing a formal complaint with the public prosecutor, and alerting relevant authorities. The company is actively investigating to ascertain the full impact of the cyberattack.

Malakoff Humanis, one of the healthcare organizations working with Viamedis, has confirmed the indirect impact of the breach on its website. It reassures its customers that no banking, medical, or contact details have been exposed and that account access and reimbursement claims are still operational. However, the temporary shutdown of the Viamedis platform may delay certain healthcare services. This situation is likely mirrored by other service providers in partnership with Viamedis, such as Carte Blanche Partenaires, Itelis, Kalixia, Santéclair, and Audiens.

Moreover, it has been reported by local French media that another payment processor for healthcare organizations, Almerys, was also targeted in the cyberattack.

The breach's aftermath includes direct notifications to affected customers and ongoing investigations to determine the breach's scope.