Hackers claim patient files from three pharmacies in Dijon, Paris and Strasbourg

When Le Moniteur des pharmacies reached the Pharmacie des Congrès in Dijon for its investigation published on November 2, the owner was at the police station filing a complaint. The pharmacy is one of three French pharmacies claimed by hackers in under 48 hours, between October 31 and November 1.

The other two are the Grande Pharmacie Bailly, on rue Saint-Lazare in Paris, and the Pharmacie de la Cigogne in Strasbourg. According to the specialist site FrenchBreaches, cited by Le Moniteur, the claims cover more than 436,000 patient records in total. That figure is unverified. It counts records, not people. At this stage, only the Dijon hack is confirmed.

What are the hackers saying about each pharmacy?

A hacker calling themselves “necrozma” says they hold four backups of the Dijon database, covering about 23,000 people. They also claim more than 303,000 records for the Grande Pharmacie Bailly. In Strasbourg, a different account, “injecteur,” announces about 110,000 people.

The site Cyberattaque.org analyzed a sample of 1,065 records attributed to the Paris pharmacy. It contains identities, addresses, dates of birth and numbers presented as social security numbers. It also includes health insurers and third-party payment bodies, with mentions of State Medical Aid (AME) and the solidarity supplementary health insurance (complémentaire santé solidaire). About thirty records concern minors. The site points out that the two volumes announced for this pharmacy, a database of more than 46,000 patients and a backup of more than 300,000 records, may overlap: they cannot be added together to count patients. A screenshot shows files that look like prescriptions, but their content could not be authenticated. As of November 1, the Grande Pharmacie Bailly had not publicly confirmed the leak.

A common entry point? No one has found it

How could pharmacies so far apart be hit at the same time? Pierre-Olivier Variot, president of the USPO union, tells Le Moniteur that the entry point may have been third-party payment operators outside the pharmacies. He admits himself that this is uncertain: no compromise of these providers has been established. Valérian Ponsinet, of the FSPF, the other major union, first thought of software shared by pharmacies. Yet nothing establishes a common vulnerability. No technical link between the three attacks has been demonstrated.

FrenchBreaches claims that several hundred other pharmacies are being monitored or targeted. The site provides neither a verified list nor proof of compromise. Valérian Ponsinet, for his part, believes large pharmacies have become attractive targets and expects more attacks in the coming days.

Patients and pharmacists: the right reflexes

The intrusion paths remain unclear, but the risks are well known. With a name, a social security number and a health insurer, a scammer can pose as your pharmacy, your health insurance fund or your supplementary insurer.

• Patients: be wary of calls, text messages or emails that mention your health insurer or a “pending” reimbursement. Never give out a code received by text message or any bank details. Call the organization back at a number you already know.
• Pharmacists: the FSPF advises logging in to professional portals directly, without clicking a link received by email. It also recommends stopping immediately if a form asks for a password, training the whole team, and reporting any abnormal behavior of a computer to the IT provider.
• Obligations: a breach that poses a risk to individuals must be notified to the CNIL (the French data protection authority), if possible within 72 hours of its discovery. Patients must be informed if the risk is high.

This is not the first time the local healthcare sector has been hit since the start of the fall. The Point Vision centers and the third-party payment provider Actil were hit before them. It remains to be seen whether the Paris and Strasbourg pharmacies will confirm, and whether the third-party payment hypothesis holds up.