Malakoff Humanis
CriticalReportedInsurance
On 17 October 2026, a threat actor using the alias ChimeraZ claimed to have released a partial database linked to the website of the French social protection group Malakoff Humanis. The actor cites 16,556 records, about 40 MB in JSON format. Samples reviewed by FrenchBreaches reportedly contain names, dates of birth, policyholder identifiers, case references, hospital care authorisation documents, reimbursement details and correspondence with claims-handling departments, along with partially masked bank details. The authenticity of the data, its exact origin (the group's own systems or a service provider) and the number of distinct people affected have not been confirmed.
Health information tied to an identity, together with case references and correspondence, could let a third party craft credible phishing messages impersonating the insurer or its claims-handling services.
- Disclosed on
- October 17, 2026
- Incident dated
- October 17, 2026
- Sector
- Insurance
- Country
- France
- Cause
- Undisclosed
Exposed data
- Full name
- Date of birth
- Postal address
- Email address
- Customer ID
- Health data
- Banking data (IBAN, card)
- Other personal data
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- Watch your statements. On any unknown debit, block the card and request a refund — French law (art. L133-18) entitles you to it.
- Health data is “special category” data under the GDPR: a leak opens a right to compensation, and the organisation must notify the DPA within 72 hours.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact