{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en"},"incident":{"id":"sante","date":"2026-08-13","year":2026,"org":"Santé publique France contractor","domain":"santepubliquefrance.fr","kind":"government","sector":"Public health","sectorLabel":"Public health","severity":"high","status":"confirmed","affected":80000,"affectedLabel":"About 80,000 contact records","data":"Email, postal address and telephone. No medical data, diagnoses or social-security numbers.","method":"Attack on a contractor-hosted ordering platform. Initial access not disclosed.","risk":"Health-themed impersonation using real contact details.","confidence":"Agency confirmation reported by French press","sourceName":"Le Parisien / AFP","sourceId":"santeParisien","sourceUrl":"https://www.leparisien.fr/faits-divers/cyberattaque-dun-prestataire-de-sante-publique-france-80-000-personnes-concernees-par-la-fuite-de-donnees-13-08-2026-FTP4SNTQI5DOVMQDCBBTQX5F4U.php","sourceIds":["santeParisien","sante"],"lastResearched":"2026-08-16","url":"/incident/sante","detail":{"lead":"Santé publique France confirmed on 13 August 2026 that a contractor-hosted platform used to order public-health prevention materials had been attacked. The affected service, moncoupon.santepubliquefrance.fr, operates separately from the agency’s other sites and systems.\n\nAbout 80,000 contact records were affected. The database was used to ship ordered materials and contained email addresses, postal addresses and telephone numbers. This is a public-health-sector breach, but not a breach of medical records.","timeline":[{"date":"2026-08-11","label":"An online claim about the platform appears, according to incident reporting."},{"date":"2026-08-13","label":"Santé publique France confirms that a contractor-operated ordering platform has been attacked and that about 80,000 contact records are concerned."}],"how":"The affected service was a separate contractor-hosted platform used for ordering prevention materials. Santé publique France said it was independent of the agency’s other websites and systems. The initial access path was not disclosed. Posts attributed to the attacker described administrator access and use of an export function; those details are an attacker account, not an official technical finding.","taken":"Contact and delivery fields such as email, postal address and telephone number. Reporting on samples also referred to professional role or organisation for some records. The agency-confirmed scale is approximately 80,000 people.","notTaken":"Santé publique France said there were no medical records, diagnoses or social-security numbers in the affected database. The platform was separate from the agency’s other systems.","impact":"The biggest practical risk is health-themed impersonation. Victims may be more likely to trust a message that knows their contact information and refers to a real prevention-material order or Santé publique France context. The brand association can amplify phishing even without clinical data.","response":"The platform was taken into maintenance, passwords were cleared, the CNIL was notified and restoration work began. Public communications emphasised that no health or social-security data was present and warned about follow-on fraud.","methodDisclosure":"partial","revision":"The case was only days old at the 16 August research cutoff. Method, contractor root cause and any later law-enforcement result remain open. Attacker claims of administrator access and an export function stay labeled as claims.","quotes":[{"text":"no health data","original":"aucune donnée de santé","originalLang":"fr","attribution":"Santé publique France, reported by French press, 13 August 2026","sourceId":"santeParisien"}]}},"source":{"id":"santeParisien","name":"Le Parisien / AFP — Santé publique France contractor, 80,000 people","url":"https://www.leparisien.fr/faits-divers/cyberattaque-dun-prestataire-de-sante-publique-france-80-000-personnes-concernees-par-la-fuite-de-donnees-13-08-2026-FTP4SNTQI5DOVMQDCBBTQX5F4U.php","publisher":"Le Parisien","kind":"secondary","published":"2026-08-13"},"sources":[{"id":"santeParisien","name":"Le Parisien / AFP — Santé publique France contractor, 80,000 people","url":"https://www.leparisien.fr/faits-divers/cyberattaque-dun-prestataire-de-sante-publique-france-80-000-personnes-concernees-par-la-fuite-de-donnees-13-08-2026-FTP4SNTQI5DOVMQDCBBTQX5F4U.php","publisher":"Le Parisien","kind":"secondary","published":"2026-08-13"},{"id":"sante","name":"E-Santé — Santé publique France contractor breach","url":"https://www.e-sante.fr/cyberattaque-chez-sante-publique-france-les-donnees-de-contact-de-80-000-usagers-piratees/actualite/744070","publisher":"E-Santé","kind":"secondary","published":"2026-08-14"}]}