Almerys confirms a cyberattack that exposed health beneficiary data

Third-party payment specialist Almerys confirmed on Monday that it had been the victim of a cyberattack that exposed the personal data of supplemental health insurance beneficiaries. The company stated that unauthorized access targeted its online claims processing system, which is used by some healthcare professionals and institutions for reimbursement requests.

According to the group, the potentially compromised data includes names, surnames, dates of birth, social security numbers, health insurance contract references, and coverage periods. However, Almerys maintains that banking information, medical data, healthcare reimbursements, and passwords were not affected by this intrusion.

Several mutual insurance companies are affected by the incident.

Following the discovery of the attack, the affected site was temporarily closed, disrupting some services in the optical, dental, audiology, and hospital sectors. The company assures, however, that its other third-party payment services remain operational and that benefit payments continue to be processed normally.

The service provider works in particular with several major supplementary organizations such as MGEN, Harmonie Mutuelle, AG2R La Mondiale or Alan, which had already called on its members to be vigilant this weekend after the revelation of the hacking.

An investigation has been opened by the Paris prosecutor's office.

Almerys states that it immediately implemented security measures to neutralize unauthorized access and limit the consequences of the attack. The company has also notified the National Commission for Information Technology and Civil Liberties (CNIL) and the National Cybersecurity Agency of France (ANSSI).

The Paris prosecutor's office has opened an investigation, which has been entrusted to the specialized unit of the police headquarters. This new incident comes more than a year after a previous massive cyberattack that also targeted the group at the beginning of 2024.