A hacker accessed the addresses and birth dates of Macif customers

On November 12, users of Macif Avantages, the discount program of the mutual insurer Macif for its members and some policyholders, received an alert email. According to the site Cyberattaque.org, which reviewed it, the email says that Qwertys, the partner in charge of the voucher service, suffered a security incident that allowed an unauthorized third party to access the data of the voucher service's users.

According to this email, reported by several specialist sites, five pieces of information are affected: last name, first name, date of birth, postal address and email address. Macif says that bank card data is not affected, nor are the login credentials for the voucher account or the Macif personal area. It also states that there is no impact on insurance contracts. According to the insurer, the service was shut down as soon as the incident was discovered. The CNIL (the French data protection authority) has been notified, and a complaint has been filed with the public prosecutor.

Who is affected, and how many people?

Macif Avantages offers discounts at more than 200 brands. According to its website, the offers are reserved for Macif members and open to policyholders of Macif Santé Prévoyance, Macif Vie, Nuoma, MNPAF and MNFCT, as well as to some beneficiaries of partnerships. The alert targets only people who used the voucher service.

How many are there? Macif does not say. As Cyberattaque.org points out, it also does not specify the date of the intrusion, how the attacker got in, or whether the data was merely viewed or actually copied. None of the sources we consulted reports a claim of responsibility by hackers.

A provider that also works for banks

The intrusion did not happen at the insurer, but at its subcontractor. According to the program's terms and conditions, cited by Cyberattaque.org, Qwertys, a Paris-based company, publishes and operates the voucher platform with its Reduc Factory solution. It is the same pattern as at Malakoff Humanis, where health reimbursements may have leaked through a provider attacked in August: the well-known brand warns its customers, but the breach opened elsewhere.

Yet Qwertys does not work only for Macif. On its website, the company says it designs benefit and loyalty programs (vouchers, discounts, partial refunds known as cashback). Its listed references include Banque Populaire, Caisse d'Épargne, Boursobank, Fortuneo, Direct Assurance, Unéo, Fnac Darty and Intersport. Was the attack limited to Macif's platform? The insurer does not say, and Qwertys has not spoken publicly, to our knowledge. Nothing indicates at this stage that other clients are affected, and we found no communication from them about an incident.

What to do if you received the email

According to Macif, neither login credentials nor bank card data are affected. The main risk comes from well-informed fraudulent messages. A scammer who knows your name, address and date of birth can convincingly pose as Macif or as a retail brand. The insurer itself warns against such fake messages.

• Be wary of emails, text messages and calls in the name of Macif or a partner brand, especially if they pressure you to validate a voucher, an offer or a payment.
• Do not click on the links you receive: go through the official website or app.
• Never give a password, a code received by text message or your bank details to anyone you did not contact yourself.
• Watch your mail: a date of birth and an address can be used to steal your identity. If that happens, file a complaint.
• For questions, the address hotline-macifavantages@macif.fr is given, according to the site E.Niort. If you fall victim to a scam, the public service Cybermalveillance.gouv.fr helps you free of charge.

This is not the first incident this month in the world of perks offered to customers and employees. On November 7, we reported that a hacker had targeted 15,000 Illicado gift cards given to employees. For Macif, two answers are still awaited: how many people are affected, and since when the intruder had access to the platform.