Hackers claim 9 million patient records from appointment service 1001RDV

On November 12, the pages of the 1001rdv.com website were replaced with a message from hackers, according to the specialist site Fuites Infos. They claim to have taken control of servers belonging to the vendor, Logicielnet, and to have stolen 22.7 GB of files. They demand $33,333 in cryptocurrency, payable within 24 hours. The deadline falls on November 13, around 1:20 p.m.

1001RDV is published by Logicielnet, a company based in Meyreuil (Bouches-du-Rhône) that was founded in 2001 and belongs to the IPContact group. It provides healthcare professionals with online calendars, appointment reminders, teleconsultation and remote secretarial services. The vendor acknowledges an attack, but says it targeted only its marketing website. At this stage, nothing makes it possible to decide between the two versions.

What the hackers say they stole

Their message, titled “Hacked,” announces a file of 9,016,504 patient records, according to FrenchBreaches. Each record would contain a first name, last name, date of birth, social security number, postal address, phone number and email address. They also claim about 290 million appointment records, some 35 million messages exchanged with medical practices, 10 million call logs, practice staff accounts and password hashes from 75 servers.

These figures come only from the hackers. A record is not a person, and 290 million appointments do not mean 290 million patients. No sample has been published. The hackers do not claim to hold diagnoses or prescriptions: according to its terms of use, the service does not handle complete medical records.

The vendor acknowledges only a hacked marketing site

In a written statement sent to Fuites Infos on November 12, Logicielnet says its marketing website, built with WordPress, was targeted, causing a temporary outage. According to the vendor, this site and its database are isolated from the business applications and the patient databases. Its investigations have so far revealed neither unauthorized access to those databases nor data exfiltration; they are ongoing. The vulnerability has reportedly been fixed, denial-of-service attacks are said to be continuing, and a criminal complaint is being prepared. By that evening, the site was working again.

Who should be believed? The defacement proves that the hackers took control of the public site, not that they reached the patient databases, though it does not rule that out, Fuites Infos notes. The contact left on the page belongs to an actor who has announced 145 leaks since April 2026, more than a third of which have been confirmed. But this actor's usual method differs: they post on forums, without defacing sites, and a third party could have reused the contact. Logicielnet, for its part, has published no technical evidence to back its denial.

Patients and medical practices: precautions to take now

Even if nothing is confirmed, the claimed data is the kind that fuels scams, and a social security number cannot be changed. The advice published by Clubic and Fuites Infos boils down to this:

• change the password of your 1001RDV account and of any service where you reused it; turn on two-factor authentication if it is offered;
• if you work in a practice that uses 1001RDV, change your passwords right away;
• if your medical practice contacts you unexpectedly, call it back on a number you already know before replying or paying;
• be wary of messages claiming to come from 1001RDV, the national health insurance fund (Assurance maladie) or a supplementary insurer: go through the official website or app, never through a link you received;
• never share a code received by text message, a password or your banking details;
• if your identity is stolen, file a complaint; Cybermalveillance.gouv.fr, the French government's cybercrime victim assistance platform, can help you free of charge.

The healthcare sector is regularly hit through its service providers, as in the hack of Maileva, La Poste's online mail service, which reached laboratory patients.

What happens next will play out in the coming days. Will the hackers publish a sample once the deadline has passed? Will Logicielnet's investigation confirm that its patient databases remained safe? If personal data was in fact affected, the GDPR would require the data controller, if the breach poses a risk to individuals, to notify the CNIL (the French data protection authority) and, in case of high risk, the people concerned.

Update of November 14, 2026

The specialist site FrenchBreaches says it obtained several samples of the data claimed against 1001RDV, the medical appointment service published by Logicielnet, directly from the hacker. It describes them without publishing them, in an article dated November 14. The first set contains patient data: first name, last name, date of birth, phone number and email address, sometimes the postal address and free-text comments. The second covers appointments (dates, times, contact identifiers, booking labels), several of which date back to 2022 and 2023. The third comes from administrative login logs: dates, account references, IP addresses, session identifiers. The hacker says they hold 6,441,347 lines of them.

According to FrenchBreaches, several of these logs explicitly mention domains and applications associated with Logicielnet, some dating from March 2016. These elements suggest a link with the company's environments. However, they make it possible neither to establish the exact origin of the data nor to confirm a recent intrusion. The authenticity of the files, their extraction date and the actual number of people affected “therefore remain to be established.” The site still classifies the case as a “credible, unconfirmed claim.”

For its part, Logicielnet has sent an official denial to FrenchBreaches. The vendor maintains that this was an attack on its marketing website on November 12. It says its investigations have revealed “no unauthorized access to the patient databases” and disputes the figure of 9 million patients.