-
A threat actor on an underground forum claims to be selling data linked to French healthcare platform MaQuestionMedicale.fr.
-
The listing allegedly includes around 95,000 patient records, 81,000 pharmacy records, and doctor identifiers.
-
The claim has not been independently verified, and no official breach announcement has been found.
A threat actor on an underground forum is allegedly selling databases containing patient and pharmacy information. The data is reportedly linked to MaQuestionMedicale.fr, a French digital healthcare platform that connects patients with doctors and medical professionals.
The Dark Web Intelligence account, @DailyDarkWeb, shared the alert online. According to their report, the listing advertises roughly 95,000 patient records and 81,000 pharmacy-related records. The actor also claims to have doctor identifiers, though the full size of the alleged dataset is still unclear.
The reported patient records allegedly include names, email addresses, phone numbers, and French Social Security numbers. In France, this number is called the Numéro d’inscription au répertoire, or NIR. The pharmacy records allegedly contain International Bank Account Numbers, also known as IBANs. If genuine, those details could expose financial information belonging to pharmacies.
These figures and data types all come from an underground market listing. They do not confirm that the data came from MaQuestionMedicale.fr. They also do not prove that the records are real or that the platform suffered any attack. No public statement from the company or from France’s data protection authority, the CNIL, has been found in the sources reviewed.
Alleged Listing Surfaces Patient Records and Banking Details
MaQuestionMedicale.fr provides digital healthcare services in France. These include teleconsultations and software that supports communication between patients and healthcare workers. The platform operates in a sector where personal data requires very careful protection.
The alleged listing covers a wide range of sensitive details. Names, contact information, and Social Security numbers together form a powerful combination. Criminals could use this mix to impersonate patients. They could also send fake messages that look like they came from real doctors, insurers, or government offices.
The alleged pharmacy IBAN exposure adds another layer of concern. Criminals could use real banking details to make fake payment requests look believable. They could also use them in business email fraud schemes. Having an IBAN alone, though, does not mean an attacker can access or take money from an account.
The CNIL warns that stolen personal data can make phishing messages much harder to spot. It recommends treating unexpected messages with caution. People should avoid clicking suspicious links or attachments. They should also contact the relevant organisation only through verified channels.
The European Union’s General Data Protection Regulation, known as GDPR, requires organisations to protect personal data carefully. It also requires them to report qualifying data breaches to the relevant authority. Where a breach poses a high risk to people, the affected individuals must also be informed. Whether these rules apply here cannot be confirmed without proof of an actual breach.
No Official Confirmation as Verification Stays Pending
The alert first spread through the Dark Web Intelligence account, @DailyDarkWeb. Their post framed the incident as an allegation, not a confirmed attack.
A search of publicly available sources found no independent reporting that confirms the listing or the claimed record counts. No statement from MaQuestionMedicale.fr and no notice from the CNIL was found at the time of writing. No verifiable comments from named users reacting to this specific listing were found either. Also, no reliable, attributable reactions could be identified without risking misrepresentation.
A separate claim involving France’s healthcare sector also alleged a large-scale data leak, with a threat actor claiming that information on 670,000 healthcare professionals had been exposed.
The next important step is independent verification. A company statement, a regulatory notice, or credible cybersecurity research would help confirm whether the claim holds up. Evidence that the advertised records match genuine historical data would also add weight to the allegation.
Until that evidence appears, this alleged sale remains an unverified threat actor claim. It is not proof that MaQuestionMedicale.fr suffered a breach.
What Patients and Healthcare Workers Should Know
Patients and healthcare workers should stay alert to suspicious messages. They should not assume their information was exposed based solely on an underground forum listing. The CNIL’s guidance on data leaks remains a useful resource for anyone concerned about their personal data in France. It explains how to check whether a leak may affect you and what steps to take if it does.
Avoid clicking on unexpected links in emails or text messages. Contact healthcare providers, insurers, or public services only through their official websites or phone numbers. Report any suspicious message to the relevant organisation directly.
