Hacker leaks data on 61,000 hearing-impaired people, blamed on third-party payer Actil

The file reportedly weighs about 237 megabytes and dates back to March 2013. Its most recent entries are from October 24, 2026, just two days before it was released for free on October 26 on a cybercriminal forum. Its author goes by Syrv4x, according to the site Cyberattaque.org. They attribute it to Actil, a Lyon-based third-party payment platform run by supplementary health insurers, including Apicil and Alptis. It is notably through this platform that policyholders can get hearing aids without paying upfront.

At this stage, neither Actil nor the insurers that run it have confirmed the leak, notes the site Fuites Infos. Like Cyberattaque.org, it analyzed the file. Its exact origin remains unknown: the hacker gives no technical details.

Who is in the file?

The hacker claims 152,187 rows, a figure that does not match the number of victims. Cyberattaque.org found 13,105 exact duplicates and counts 60,790 distinct Social Security numbers. Fuites Infos arrives at 60,806 distinct policyholders. Nearly nine in ten are 60 or older, and 220 are minors, according to the latter.

The information on each policyholder is sensitive. It includes name, date of birth, Social Security number, supplementary health insurer and member number, but also details of the device: which ear is fitted, and the brand and model of the hearing aid. It also includes the price, the amounts reimbursed and the out-of-pocket cost. Both sites also found a blindness flag, set for 428 people according to Cyberattaque.org. This is therefore health data, which the GDPR protects more strictly. According to Fuites Infos, the file reportedly contains no email addresses, phone numbers or bank details.

Why scams could follow

With no email or phone number, where is the danger? Scammers gain credibility. A fake advisor who knows the name of your health insurer, the brand of your device and what you paid out of pocket inspires trust. Both sites warn about fake calls or letters posing as coming from a health insurer, a third-party payer or a hearing-aid specialist. Combined with civil status data, the Social Security number could also be used for identity theft, warns Fuites Infos.

Most of the people affected are elderly, and it often falls to their relatives to warn them.

Best practices

• Do not give any information to a caller claiming to be your health insurer or hearing-aid specialist without verifying: hang up and call the organization back yourself at the number on your card or contract.
• The Assurance Maladie (France's national health insurance) never asks for bank details by email or text message, Fuites Infos reminds readers. If in doubt, go through your ameli account or your member portal.
• Talk to relatives who wear hearing aids, especially if they live alone.
• The site cybermalveillance.gouv.fr offers free help to scam victims.

The main question remains: was Actil hacked, or did the data come from another link in the chain? Cyberattaque.org points out that an insurer named in the file was not necessarily hacked itself, and favors no lead: application flaw, compromised business account, API or another system. Only Actil or the insurers can answer. If the leak is confirmed, the data controller will also have to notify the CNIL (the French data protection authority). The service-provider scenario would not be unprecedented: at Malakoff Humanis, health reimbursements may have leaked through a compromised service provider.