Health data, Social Security numbers, key hiding spots: a hacker claims to be selling ADMR files

Where is the key kept, what is the door code, what care is planned? For a home-care aide to enter an elderly person's home, these details have to be written down somewhere. According to two specialist sites that examined a sample, some of them appear in files that a hacker claims to have stolen from ADMR, one of the main nonprofit home-care networks in France.

The listing was posted on October 23 on a cybercrime forum, according to Fuites Infos. The seller, who goes by "novembegolf" according to Cyberattaque.org, claims to hold 4,541,053 rows (1.81 GB) and is offering the full file for sale. At this stage, ADMR has made no public statement confirming a data theft: for now, this remains a claim.

What does the sample released by the hacker contain?

To lure buyers, the seller posted a sample for free. Cyberattaque.org counted 12,818 records of beneficiaries and members of their households, often very elderly. They include civil status, date and place of birth, nationality, family situation and household composition. 4,967 records include a number presented as a Social Security number, or 4,835 distinct numbers once duplicates are removed: nearly four records in ten.

The most sensitive information is in the free-text comments. According to Cyberattaque.org, 844 records describe reduced mobility, memory problems, treatments, nurse visits or help with bathing. Some notes give the location of a key, the presence of a safe, a badge or a door code. The site also found 463 records of minors and notes dated 2025 and 2026.

Be careful with the numbers: 4.5 million rows does not mean 4.5 million people, since the same person can appear several times. According to the network's figures cited by Cyberattaque.org, ADMR has about 720,000 clients.

Where might these files come from?

The hacker presents the operation as a "scrape" of the admr.org website, meaning a simple harvesting of its pages. Cyberattaque.org considers this wording misleading: the files look like internal management data, not public pages. The site points out that the network has used the Philia and PhiliaSanté software, without establishing that either is involved. According to Fuites Infos, two screenshots of an application attached to the listing also show addresses and phone numbers.

This is not the first alert. On October 1, another claim involved about 9,700 accounts on the network's intranet (employees, managers and volunteers). In April, another hacker said they held 5,280 accounts. No link has been established between these episodes.

What beneficiaries and their families should do

No sophisticated hacking is needed to exploit such data: a well-informed phone call is often enough to deceive an elderly person. While waiting for a statement from ADMR:

• warn the relatives you help: neither their association, nor the national health insurance system (Assurance maladie), nor a bank will ask for a code, a password or a transfer by phone;
• be wary of a caller or visitor who knows health details or the care plan: hang up and call the local association back on its usual number;
• if a key hiding spot or an access code was given to the association, change them;
• monitor the reimbursements shown on the ameli account to spot any unusual use of the Social Security number.

As in the breach at Malakoff Humanis, this would involve health data, which is especially protected under the GDPR. If the intrusion is confirmed, the network, which federates nearly 2,700 local associations, will have to notify the CNIL (the French data protection authority) and, given the sensitivity of the data, inform the people concerned. What remains to be learned is which tool was affected, and when.