Malakoff Humanis: your health reimbursements may have leaked via a provider hacked in August

Hospital coverage authorizations, reimbursement statements, optical and pharmacy invoices, and even mentions of IBANs or bank statements. On October 17, a hacker using the handle ChimeraZ posted a roughly 40 MB file on a cybercriminal forum, presented as a partial database of Malakoff Humanis: 16,556 documents in total.

On October 18, the social protection group gave its account to Cyberattaque.org, which updated its article. Malakoff Humanis confirms a cyberattack on IGA, a provider that manages about 2,000 of its policyholders. It says it learned of the attack on August 11, 2026. However, it is still verifying the authenticity, origin and extent of the published data.

What does the leaked file contain?

According to the analysis by Cyberattaque.org, which says it obtained the database, the documents combine names, postal addresses, dates of birth, member numbers and social security numbers. They also include healthcare data: consultations, lab tests, medical transport, hospital stays. More than 800 entries contain an IBAN or a bank statement, some of which belong to organizations that were paid rather than to policyholders. The most recent documents date from August 7 and 8, 2026, just days before the discovery announced by the group.

The site Fuites Infos, which also examined the file, reaches a similar reading. It says this would not be a database from the Malakoff Humanis website, but management emails and letters sent to IGA Gestion mailboxes, mostly dated from December 2025 to August 2026. It counts about 2,600 distinct policyholders. The two figures do not measure the same thing: 16,556 documents do not mean 16,556 victims, because the same policyholder can appear several times.

Why go through the administrator rather than the insurer?

IGA Gestion manages health and provident insurance contracts on behalf of other organizations. According to Fuites Infos, it handles files under the Malakoff Humanis brand from a center in Tours. These subcontractors concentrate highly sensitive data, often with less visibility than the insurer itself. Paris hospitals learned this the hard way with their patients' meal-ordering software. The hacker gave no details on how they got in. That point remains unknown.

The ChimeraZ handle is not new. Cyberattaque.org and FrenchBreaches attribute it to this hacker, while Fuites Infos says the handle was masked on the screenshot it saw.

Policyholders: what to do

Malakoff Humanis says it has notified the CNIL (the French data protection authority) and the relevant authorities, and says it will inform the affected policyholders. In the meantime, with a name, a social security number and care details, a scammer can very convincingly pose as your health insurer.

• Be wary of emails, text messages or calls that mention a reimbursement, a hospitalization file or a change of bank details (RIB). The group reminds customers that its advisers never ask for a password or security code.
• Monitor your bank statements and report any unknown debit to your bank.
• If in doubt, call your administrator back at the number printed on your third-party payer card, never at the number given by the caller.

It remains to be seen how many policyholders will ultimately be notified, and whether other organizations whose contracts IGA manages are affected.