AP-HP: Data of 1,015 patients stolen via meal-ordering software

The Assistance publique – Hôpitaux de Paris (AP-HP), the public hospital system of the Paris region, confirmed on October 7 the theft of identity data belonging to 1,015 patients. The attackers went through the online service of a meal-ordering software called SRD Restauration, published by the company Dedalus and used in 23 of its hospitals. According to the institution, no medical data would be affected. The count remains provisional: the attackers claim to hold more.

A sale offer spotted on September 24

According to its statement, AP-HP was alerted on September 24 that data from this software was being offered for sale on a cybercriminal forum. Its digital services department investigated for several days, with its partners and the authorities, before confirming the theft. The theft reportedly took place a few days before the alert, through an intrusion into the online service where hospitalized patients choose their meals.

The stolen information includes last name, first name, birth-related details and the internal patient ID number. Given the nature of the software, AP-HP believes that no direct or indirect medical data, no administrative or banking information and no contact details would be affected. The conditional is its own: the investigation is ongoing.

The 23 hospitals that use the software are Ambroise-Paré, Antoine-Béclère, Armand-Trousseau, Avicenne, Bicêtre, Broca – La Collégiale, Charles-Foix, Cochin – Port-Royal, the Georges-Pompidou European Hospital, the Berck maritime hospital, the Hôtel-Dieu, Lariboisière – Fernand-Widal, Louis-Mourier, Necker – Enfants malades, Paul-Brousse, the Pitié-Salpêtrière, Raymond-Poincaré, Rothschild, Saint-Antoine, Saint-Louis, Sainte-Périne, Tenon and Vaugirard – Gabriel-Pallez.

Broader claims, not confirmed

On the forum, the attackers cite a higher number of patients, as well as data concerning accounts of AP-HP staff who use this software. The institution says it is continuing its investigations to verify these claims, which it does not confirm at this stage.

The online module is closed until further notice. AP-HP and its suppliers reset the passwords of all users and fixed the vulnerabilities suspected of having enabled the theft. The CNIL (the French data protection authority) and the cybersecurity support unit for healthcare organizations were notified, and a complaint was filed the day after the alert.

AP-HP experienced a false alarm last winter: in mid-December 2025, an internet user claimed to hold data from their electronic patient record, and the alert was lifted in January for lack of evidence, Clubic recalls. In 2021, by contrast, a leak exposed the data of more than one million people, according to 01net.

What to do if you were hospitalized at AP-HP

• A name, a date of birth and a hospital stay are enough to make a fake call or message believable. Be wary of any unexpected contact that mentions a hospitalization, an invoice or a reimbursement.
• Never share a password, a code received by SMS or bank details with someone who contacts you, even if they know your identity. If in doubt, call the hospital back at the number listed on its official website.
• For healthcare organizations: an ancillary service open to patients on the internet, such as meal ordering, is part of the attack surface. It deserves the same inventory, the same authentication and the same monitoring as clinical applications.