Hacking of 34 million medical records: Health Insurance denies, hacker persists

This June 2, 2026, several cybersecurity influencers reported a potential hacking of the Shared Medical Record (DMP) database. More than 34 million accounts affected, or almost half of French people. An earthquake. The information was widely reported.

No hack detected yet

For my part, I contacted Health Insurance to get their feedback on the situation. They knew about it and were investigating. This evening, a second email reached me, wanting to disarm the situation: no, there would have been no leak of the DMP files.

“According to the in-depth investigations carried out by specialists in our information and cybersecurity systems, we have not found any evidence of a massive data leak from the Shared Medical File (DMP),” explains Health Insurance.

The organization adds that “Our experts have verified whether a leak could have occurred via the operating procedures presented in the claim and indicate that no attack of this type has yet been detected. They also did not note any abnormal activity in volume via e-cps access [practitioner access, Editor's note]. »

We note it, the words are chosen. For the moment, nothing has been detected, after approximately 24 hours. So chances are there's nothing. “Our investigations are continuing in order to be able to consolidate these conclusions,” adds the email.

The hacker comes back

But Lagui, the hacker who claims this hacking, reacted. As FrenchBreaches.com reports, he “shared new evidence aimed at supporting his claims.”

In the event that he put his nickname in the boxes of the DMP, he would have moved on to the disclosure of “a nurse’s account following a social engineering operation. To support his statements, he notably distributes the name and first name of the professional concerned as well as several screenshots presented as proof of access to the account. »

I deliberately use the conditional since FrenchBreaches himself specifies that for the moment “these assertions have not been independently corroborated. »

But one thing is certain, the case is not closed, especially since Health Insurance tells us at the very end of its communication that “at the same time, the Cnam will initiate a report to the public prosecutor under article 40 of the code of criminal procedure. » But if there is nothing, why initiate proceedings?