Cegedim Sante Breach Exposes 15.8 Million French Medical Records, 16 Months After CNIL Fined the Company for Data Violations
Attackers stole 15.8 million patient files, including doctors' notes with HIV status and sexual orientation, from a French health-tech vendor already fined for mishandling medical data.
Overview
Attackers breached French health-tech vendor Cegedim Sante in late 2025 and stole 15.8 million patient records from its MonLogicielMedical (MLM) platform, according to The Register. The breach, which first became public on February 27, 2026, when France 2 television broadcast a report on the incident, ranks among the largest healthcare data exposures in European history.
The breach is notable not only for its scale but also for its context: the French data protection authority CNIL fined Cegedim Sante 800,000 euros in September 2024 for illegally processing health data without authorization. Sixteen months later, the company suffered a breach that exposed the very type of sensitive information regulators had flagged.
What We Know
The stolen data encompasses administrative files from roughly 1,500 of the 3,800 medical practices that use Cegedim’s MLM software, as reported by France 24. The files contain patient names, genders, dates of birth, phone numbers, home addresses, and email addresses.
Among the 15.8 million administrative files, approximately 169,000 contained personal annotations written by doctors. In what Cegedim described as “very limited cases,” these notes included sensitive medical details such as HIV-positive status and patients’ sexual orientations, according to The Register. The breach also affected high-profile individuals, including political figures and national security officials, as reported by France 24.
Cegedim Sante stated that structured medical records remained intact and that only administrative data was compromised. The company filed a criminal complaint with the Paris prosecutor’s office in October 2025, but the breach did not become public until nearly four months later when France 2 aired its report.
Prior Regulatory Action
The breach comes after a September 2024 enforcement action by CNIL, which found that Cegedim Sante had been collecting patient data from approximately 25,000 medical practices via its “HRi” teleservice without authorization. The company claimed the data was anonymized, but CNIL investigators determined it was merely pseudonymized, meaning patients could be re-identified through technical means. The 800,000-euro fine cited violations of both the GDPR and the French Data Protection Act.
As part of that action, CNIL noted that Cegedim’s system automatically downloaded patient data during teleservice consultations without providing doctors the option to merely view it, a practice the regulator found unlawful under GDPR Article 5.1.a.
What We Don’t Know
The identity of the attackers has not been publicly disclosed. It is unclear whether the stolen data has appeared on dark web marketplaces or been used for extortion. The technical details of how the breach occurred, including the initial attack vector, have not been revealed by Cegedim or French authorities.
CNIL has not announced whether it will open a new investigation into the breach or whether the company could face additional penalties. The French Health Ministry has stated that doctors’ personal annotations do not violate GDPR regulations, a position that may face scrutiny given that some of those annotations contained protected health information.
Analysis
The four-month gap between Cegedim’s internal discovery and public disclosure raises questions about breach notification timelines under GDPR, which generally requires organizations to notify supervisory authorities within 72 hours. The Cegedim case suggests that even companies recently subjected to regulatory scrutiny can experience systemic failures in data protection.
The breach also highlights a structural vulnerability in healthcare IT: free-text fields in medical records, which escape the automated monitoring and standardization applied to structured data such as diagnosis codes and prescription records. These unstructured comment areas can contain highly individualized clinical observations, making them uniquely damaging when exposed and difficult to remediate after the fact. The breach affected senior politicians among the millions of victims, according to TechRadar, underscoring the breadth of the exposure.