ISTANBUL

A massive data breach concerning the data of 15 million people in France has been revealed after a cyberattack targeted 1,500 doctors using medical software.

The administrative data of around 15 million French citizens, along with notes written by their doctors, were leaked in a large-scale breach targeting 1,500 doctors using a medical software from Cegedim Sante in late 2025, broadcaster France 2 revealed on Thursday.

The media outlet revealed that it had accessed an openly available database containing the health data of 15 million French patients, comprising sensitive medical details and doctor notes about patients such as "HIV-positive," "veiled Muslim mother" and "son in prison."

Meanwhile, the French Health Ministry, disclosing the data breach, reportedly noted that doctors recording such annotations about patients’ daily life and private matters do not violate the General Data Protection Regulation.

The database reportedly includes high-profile political figures, potential presidential candidates, senior civil servants, and national security officials.

Cegedim Sante, a subsidiary of the Cegedim Group, also confirmed the attack targeting 1,500 doctors using their software, reaffirming that they filed a complaint with the public prosecutor.

"The information involved comes exclusively from patients’ administrative records: name, first name, gender, date of birth, phone number, address, email, and administrative notes in free text at the discretion of the doctors. For a very limited number of patients, these notes may have contained personal annotations from the doctor regarding sensitive information. Patients’ structured medical records remained intact," the statement said.

The Health Ministry stressed that around 169,000 patients are involved, specifically in notes containing personal annotations from doctors regarding sensitive information.

It, however, noted that it does not have full visibility over the extent of the administrative data of the 15 million people in the leaked databases.

Investigations are still ongoing after the Paris prosecutor’s office launched a probe on Nov. 3, 2025, for offenses against an automated data system.