Point Vision eye centers confirm patient data was stolen

Two emails, a month apart, don't quite tell the same story. In late October, patients of Point Vision, a network of eye care centers, received a second message about the cyberattack that hit its appointment-booking provider. Clubic reported it on October 23, ZATAZ on October 24. This time, the group acknowledges that databases were downloaded. Yet one item has vanished from the list: the social security number.

According to Acuité, Point Vision has 67 practices, more than 900 healthcare professionals and about 1.6 million patients a year. The group has still not said how many of them are affected.

What the second email says

According to Clubic and ZATAZ, which reproduce its content, Point Vision's data was not hosted by the provider. A vulnerability in the provider's tools reportedly allowed an unauthorized person to enter Point Vision's appointment management environment and extract databases. These databases contain names, first names, dates of birth, postal addresses, email addresses, phone numbers and some exchanges about appointment scheduling.

Point Vision adds that it cannot rule out that account passwords and reasons for consultation were accessed or downloaded, because the attacker erased some of their traces. Medical records are stored on other systems, and no unauthorized access to them has been found so far, according to the group. The appointment software is suspended. Another solution replaces it pending new security checks.

A social security number that disappears

The first email, sent in September, presented the case differently. According to Fuites Infos and Acuité, it mentioned possible access to data and explicitly cited the social security number. In the meantime, the affair has grown. Fuites Infos notes an initial claim targeting the medical scheduling software vendor Alaxione as early as August 19. On September 28, a seller offered on a forum a database they say was extracted from 168 medical centers, including 67 Point Vision centers. These figures come from the seller and have not been confirmed.

Fuites Infos says it examined the published sample. It reportedly contains Point Vision patient records, some of which include the social security number, password hashes (not plaintext passwords), messages between secretaries and practitioners, text messages and records of minors. According to the site, some data is dated up to September 28, which is after the first notification. Point Vision does not name its provider in the email reported by Clubic.

What to do if you are a patient

The main risk is not a hack of your bank account, but highly credible scams. A fraudster who knows your name, your date of birth and the date of your last appointment can pose as the center, a doctor or the national health insurance system (Assurance maladie). Point Vision itself points this out: knowing this information does not prove that the person contacting you is legitimate.

• Do not share any password or confidential code in response to an unexpected request. Point Vision also states that no payment or bank details request will be sent to secure an account.
• If you used the same password elsewhere with the same email address, change it on those services.
• Be wary of links and attachments that mention an appointment, a reimbursement or a medical document.
• If in doubt, call the center back at a number you already know, not the one in the message.

The story echoes that of the members of Malakoff Humanis, whose health reimbursements may have leaked through a provider. Two questions remain open: how many patients are affected, and why the social security number no longer appears in the second email.