Clin d'œil Opticiens warns customers their Social Security numbers may have leaked

The email went out to current and former customers of Clin d'œil Opticiens. The chain acknowledges a “security incident”: a file containing customer data was published online without authorization. The site Fuites Infos made it public on October 22, followed by Cyberattaque.org on October 23, each quoting the company's message.

According to the email, the file contains customers' last name, first name, gender, date of birth, postal address, phone number and email address. Most importantly, it contains their Social Security number, known as the NIR. The company has notified the CNIL, the French data protection authority.

How many customers are affected?

Nobody knows. The chain gives no figure. According to Fuites Infos, the message was sent to the entire customer base, but it says only that each recipient “may” be affected. It is also unknown when the file was extracted, where it was published and how it was obtained.

Clin d'œil Opticiens is an independent, family-owned chain founded in the late 1980s. It operates in eleven cities in northeastern France, including Strasbourg, Nancy, Reims, Mulhouse, Belfort, Colmar and Charleville-Mézières. The company says it has opened an investigation with its technical providers and taken steps to secure its systems. It promises to notify customers again if the scope of the leak changes.

Have prescriptions leaked?

That is the question eyeglass wearers are asking. The chain is still checking whether any information about vision care or supplemental health insurance is in the file. So far, its investigations have not shown a leak of that data. According to Cyberattaque.org, in-store appointments, third-party payment and equipment follow-up are working normally.

Even without prescriptions, the NIR makes this leak sensitive. It cannot be changed, and it lends credibility to a scammer posing as a health insurer, a public health insurance fund or an optician. This scenario has already happened this year at a supplemental health insurer, with the health reimbursement leak at Malakoff Humanis.

What to do if you are a customer

No one needs to hack anything with this file: all it takes is a phone call quoting your Social Security number to sound credible.

• Be wary of calls, texts and emails about a reimbursement, a new Carte Vitale (French health insurance card), a health insurance update or optical equipment, even if they quote your real information.
• Never share your bank details, passwords or a code received by text with someone who contacted you.
• If in doubt, call back yourself your store, your health insurer or the public health insurance system (Assurance maladie), using a number you already know.
• Check your ameli account regularly (the online Assurance maladie portal) and your reimbursement statements for any transaction you do not recognize.

It remains to be seen how many customers are in the file and where it came from. The company has not yet clarified either point.