Softway Medical admits health data theft from its radiology software

On Thursday, November 5, hackers logged in to One Manager from outside a radiology practice, using a stolen identity. That is how the vendor Softway Medical describes the attack on this software, which manages the path of an imaging exam, from booking the appointment to the report. According to the trade site Docteur Imago, the company says the attackers managed to extract health data.

Based in Fuveau (Bouches-du-Rhône), the group confirmed a "data breach" on this radiology information system in a statement dated November 8. Of the 1,100 radiology customers it claims, "a few dozen" are affected, André Brunetière, its product and technology director, told Docteur Imago. The number of patients affected has not been disclosed.

A hospital hit even though it had switched software

Reims University Hospital (CHU de Reims) is among the institutions notified. On November 8, the vendor's data protection officer, whom the hospital refers to as Softway Medical Imaging, informed it of a personal data breach. It targets a solution that let patients treated between October 2019 and April 2026 view their imaging results remotely. Yet the hospital had stopped using this software in April.

In a message updated on November 10 and relayed on the 13th by France 3, the hospital says its imaging activity is not disrupted. It reported the incident to the CNIL (the French data protection authority) and plans to file a complaint. According to the hospital, the affected data include neither medical results nor financial or billing information. It is, however, waiting for the vendor's investigations to learn the exact nature of the data.

Health data or just contact details?

The two accounts remain to be reconciled: the vendor speaks of extracted health data, while the hospital rules out medical results. Neither has published the list of information taken. Softway Medical highlights regular penetration tests and ISO 27001-certified processes, and acknowledges that, "despite these measures," malicious actors succeeded. A root-cause analysis is under way with outside experts.

How to know if you are affected

According to the vendor, it all started with a remote login under a stolen identity: external access to medical software remains a door to watch. Softway Medical says it has notified all affected customers, and states that those who received no notification are not affected.

• Patients: if in doubt, ask the data protection officer of the center where you had your exam. For Reims University Hospital, the address given is dpd@chu-reims.fr.
• Be wary of messages: an email, text message or call mentioning an imaging exam or appointment may draw on this data. Do not give out banking details or passwords, and call the center back on its usual number.
• Imaging centers: Softway Medical has shut down external access, with a gradual reopening planned the week of November 9, along with customer support. This is the time to check who can log in from outside, with which accounts, and whether two-factor authentication is required.

The key questions remain: how many patients, which centers, and how the identity used was obtained. As at the AP-HP (the Paris public hospital network), where hackers got in through the patient meal software, the breach came through an outside vendor's software.