A cyberattack has led to the exposure of personal information belonging to 1,015 patients of the AP-HP, a major public hospital group in France. The data, including names, first names, birth dates, and internal identifiers, was reportedly put up for sale on a cybercriminal forum. The breach occurred through a meal ordering system used by patients in 23 of the group’s hospitals. This system allowed individuals to choose their meals online, and the hackers exploited this service to access the data. The incident was first raised in mid-December 2025, when an online user claimed to have obtained electronic patient records from the AP-HP. After weeks of investigation, the hospital group found no evidence of a data breach and lifted the alert in January. However, the situation has now been confirmed. On September 24, the AP-HP was informed that patient files were being sold on a cybercriminal forum. Following an investigation with partners and authorities, the group confirmed on Wednesday that 1,015 individuals’ data had been stolen. The number is provisional, as the hackers claim to have more patient data and staff accounts linked to the meal ordering software. The AP-HP has taken immediate steps to mitigate the risks. It has reset passwords for all users, as the hackers reportedly obtained staff accounts through the meal software. According to the AP-HP, no medical, administrative, banking, or contact information was involved in the breach, due to the nature of the meal system. However, the stolen data could still be used by fraudsters for identity theft or phishing attacks. The AP-HP has informed the CNIL, France’s data protection authority, and the cybersecurity support cell for health institutions. It also filed a formal complaint on September 25 to initiate an investigation. To help individuals affected by such breaches, the Cybermalveillance.gouv.fr platform, which monitors online threats, advises victims to be cautious of calls or messages that use personal information to appear legitimate. On October 1, during Cybermonth, the platform, in collaboration with the CNIL, published a guide for victims. It recommends changing compromised passwords, especially for primary email accounts, and enabling two-factor authentication. In the weeks following the breach, individuals should monitor their bank accounts and report any suspicious activity immediately. In the long term, the CNIL and Cybermalveillance.gouv.fr suggest limiting the sharing of personal information and deleting unused accounts to reduce the risk of future breaches. Earlier this year, the CNIL fined the Private Hospital of the Loire in Saint-Étienne 500,000 euros after a similar data theft, citing poor security practices.