Three French pharmacies hacked, exposing over 436,000 files with sensitive data, sparking fears of intensified cyberattacks on the pharmaceutical network.
Pharmacies targeted in multiple cities
Between October 31 and November 1, three pharmacies in Paris, Strasbourg, and Dijon were identified as victims of hacking. According to information published on November 2 by FrenchBreaches, the hackers claim to have stolen more than 436,000 files containing sensitive administrative and medical data. In Dijon, the hacking of the Pharmacie des Congrès is confirmed. A member of the team indicated that the owner was at the police station to file a complaint following the attack, as reported by Le Moniteur des pharmacies.Details of stolen data revealed
The cybercriminal "necrozma" claims to have recovered four database backups concerning approximately 23,000 people. FrenchBreaches analyzed a sample of 1,000 records attributed to the pharmacy. Among them, 941 contain a social security number, 945 a date of birth, 751 insurance information, and 334 are classified in the "Child" category.More claims of data theft
In Paris, the same hacker claims to have stolen more than 303,000 files from the Grande Pharmacie Bailly. In Strasbourg, another cybercriminal, "injecteur," claims to have recovered data from approximately 110,000 people at the Pharmacie de la Cigogne. These figures remain to be confirmed.Uncertainty about attack origins
Pierre-Olivier Variot, president of the Union of Pharmacists' Unions (USPO), mentions a possible intrusion by "third-party payers' operators external to the pharmacy." He notes the uncertain nature of this information and wishes to gather more elements before commenting. No compromise of these service providers is currently established.No common vulnerability identified
Valérian Ponsinet, president of the Convention and Information System Committee of the Federation of French Pharmaceutical Unions (FSPF), indicates that he has considered a common information vulnerability. He initially considered the hypothesis of a compromise of a software used in pharmacies, which could explain the succession of these attacks. However, at this stage, no element allows establishing the existence of a common vulnerability. No technical link between the three attacks has been identified.Concerns about increasing threats
Ponsinet suggests these events could mark an evolution in the threat, noting that cybercriminals now seem to identify large pharmacies as particularly attractive targets, which could lead to an intensification of attacks against the pharmaceutical network. He fears an intensification of hacking in the coming days.Wider potential for cyberattacks
According to FrenchBreaches, several hundred other French pharmacies may be monitored or targeted by cybercriminals. The site, however, provides no verified list, and nothing allows affirming that these establishments have already been compromised.Risks posed by stolen data
The potentially stolen data associate identity, social coverage, and medical prescriptions, all information that could fuel fraud or identity theft attempts.Prevention and response measures
Ponsinet calls on teams to be wary of fraudulent emails playing on urgency, such as pending reimbursement, administrative procedures, or imminent deadlines. He recommends connecting directly to professional portals rather than following links received by email. He advises stopping form filling immediately if clicking on a link triggers security-related questions, such as a password.Importance of staff awareness
He emphasizes the importance of sensitizing all staff to cyberattack prevention, noting that each employee must be able to identify fraud attempts and adopt the right reflexes when facing suspicious digital requests. He recalls that pharmacies receive daily electronic documents from patients and health insurance providers.Procedures for detected breaches
In case of unusual behavior from a computer workstation, he recommends contacting the IT service provider immediately. When a hacking is detected, he emphasizes the need to file a complaint.Regulatory obligations
From a regulatory standpoint, a personal data breach likely to pose a risk to individuals must be reported to the National Commission on Informatics and Freedoms (CNIL) as soon as possible and, if possible, within 72 hours of discovery. Patients must also be informed when the risk is high, except for exceptions provided by the GDPR.
