Hacker claims to have stolen medical data

A hacker known as "Feel" has allegedly stolen over 369,000 messages from MaQuestionMedicale, a French online medical consultation service, and is selling them on the dark web. The messages, attributed to the service, reportedly contain patient-doctor exchanges, including symptoms, prescriptions, and personal details like names and phone numbers.

Data spans multiple years and includes sensitive exchanges

According to FrenchBreaches, a French data breach tracking site, the messages date from 2019 to 2026 and include communications between patients and doctors. These exchanges cover a range of medical topics and personal information, raising concerns about privacy and data security.

Service allows free online consultations

MaQuestionMedicale allows patients to consult doctors online without an appointment and obtain prescriptions or medical certificates. Since January 1, 2024, the insurance company Assuréo has offered the service for free to its policyholders, increasing its usage and potential exposure.

Hacker suggests account compromise led to breach

The hacker claims to have accessed the data "directly from a patient's access," implying that a compromised account allowed access to other users' messages. FrenchBreaches and Cyberattaque.org, a cybersecurity website, mention a possible security flaw called IDOR, which could allow logged-in users to access any consultation without verifying ownership.

Sample data raises questions about timeline

A sample of 1,000 messages obtained by Cyberattaque.org shows real medical exchanges, but most of the data appears to be from 2019, with only 11 from 2020. This raises doubts about the hacker’s claim that the data goes up to 2026, suggesting the timeline might be exaggerated or incorrect.

Unclear how many individuals are affected

It is unclear how many unique patients are affected, as 369,000 messages do not necessarily mean 369,000 individuals. MaQuestionMedicale has not publicly responded to the breach claim, leaving users uncertain about the extent of the exposure.

France faces ongoing health data security issues

This breach adds to a series of reported or alleged hacking incidents targeting French health data, including the leakage of 11 to 15 million medical records in February and 34 million accounts from the National Health Insurance Fund in June. Users are advised to be cautious of suspicious SMS or emails requesting prescriptions or consultations.