Hacker claims to sell Social Security numbers of 21,700 Aréas Assurances policyholders

On November 7, at 11:51 a.m., a listing was posted on a cybercriminal forum. Its author, who goes by "webshell" according to the site Cyberattaque.org, claims to hold a database of policyholders of Aréas Assurances, a French mutual insurance group. They are looking for a single buyer.

According to the listing, the file contains 26,347 rows, or 21,732 distinct policyholders once duplicate Social Security numbers are removed. As of November 8, Aréas has not publicly confirmed any breach, and it is unknown how the data would have been obtained. At this stage, it is therefore only a claim.

What the file allegedly contains

Cyberattaque.org and the site Fuites Infos both relayed the listing. According to them, each record allegedly contains the last name, first name, date of birth and Social Security number, complete with its check digits according to Cyberattaque.org. It would also include contract and member numbers, the health insurance scheme (according to Fuites Infos), the coverage purchased and the validity period of the rights. The file would also indicate whether the policyholder has an account on the online customer portal.

According to Fuites Infos, the database would also include minors and family composition. According to the claim relayed by Cyberattaque.org, 8,767 people have active health coverage. No diagnosis or medical record is mentioned. The database would be sold in CSV and JSONL formats, at an undisclosed price.

What the sample shows, and what it does not prove

The hacker released a short excerpt. Cyberattaque.org examined five rows. The five check digits of the Social Security numbers are valid. The organization code shown does match Aréas in the healthcare sector's reference databases. But on one of the records, the date of birth does not match the one encoded in the Social Security number. The site considers these clues insufficient to validate all 21,732 policyholders. The samples also do not make it possible to tell when the data would have been obtained.

The Social Security number poses a particular problem: unlike a password, it cannot be changed. This is not the first time such data has circulated, as with the Clin d'œil Opticiens alert or the alleged leak of health reimbursements at a service provider of Malakoff Humanis.

Aréas policyholders: what to do

A scammer needs no technical skill to exploit this kind of file: quoting your contract number over the phone is often enough to seem credible.

• Be wary of calls, text messages or emails in the name of Aréas, your supplementary health insurer or the national health insurance system (Assurance maladie), especially if they mention your contract or coverage. Assurance maladie never asks for your bank details by email or text message.
• Do not click on links you receive: log in directly to your customer portal or your ameli account.
• If in doubt, hang up and call your insurer back at the usual number.
• Explain to children covered by your contract that an unexpected message may be a scam.
• If you fall victim to a scam, the cybermalveillance.gouv.fr service provides free assistance.

If the leak were confirmed, the GDPR would require Aréas to report it to the CNIL (the French data protection authority) without undue delay and, where feasible, within 72 hours of becoming aware of it. It would also have to notify policyholders directly if the risk to them is high. That is the next step to watch.