{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en"},"incident":{"id":"weda","date":"2025-11-10","year":2025,"org":"Weda","domain":"weda.fr","kind":"company","sector":"Healthcare","sectorLabel":"Healthcare","severity":"critical","status":"confirmed","affected":null,"affectedLabel":"23,000 health professionals operationally locked out; patient count unknown","data":"Cross-tenant patient-data risk via API. Patient count unknown; 23,000 is operational lockout of health professionals.","method":"Authenticated customer accounts plus a cross-tenant API authorisation weakness.","risk":"Patient-care disruption plus potential exposure of highly sensitive health information.","confidence":"WEDA’s CNIL-notification material; patient count still under investigation.","sourceName":"WEDA","sourceId":"wedaCnil","sourceUrl":"https://assistance.weda.fr/hubfs/2025-11_Notification%20violation%20CNIL%20WEDA.pdf","sourceIds":["wedaCnil","wedaCnilDirect","wedaLemonde","weda","wedaCaducee","wedaAvec"],"lastResearched":"2026-08-16","url":"/incident/weda","detail":{"lead":"WEDA’s own material prepared to help customers complete CNIL breach notifications states that monitoring detected an abnormal activity spike at 17:00 on 10 November 2025 on a customer account making many API calls. Once a user was authenticated to a WEDA customer account, the API could return patient data even when those patients were not attached to that healthcare professional’s account.\n\nAround 23,000 health professionals lost normal access when WEDA shut the application at 23:00. That figure is operational lockout, not a patient count. WEDA classified the event as a confidentiality loss and listed patients as the affected category, while stating that the approximate number of records and people was still under investigation.","timeline":[{"date":"2025-11-10","label":"17:00: abnormal API activity on a customer account. A second account shows the same pattern around 21:00. At 23:00 WEDA shuts the application for all users."},{"date":"2025-11-11","label":"CNIL says it has been informed of the WEDA data breach from this date."},{"date":"2025-11-12","label":"WEDA mobilises forensic support, files a complaint with the Police nationale, and begins exchanges with ANSSI."},{"date":"2025-11-14","label":"Partial access resumes. Login plus password alone is no longer sufficient; Pro Santé Connect or CPx is required, and vulnerable endpoints are decommissioned."}],"how":"The suspicious activity came through authenticated customer accounts. The relevant API had an authorisation-boundary problem: a connected customer account could query patient data not attached to that professional. That is a failure of authorisation after a valid session, not merely an unspecified server intrusion. The material does not establish how the attacker obtained control of the customer accounts — phishing, credential stuffing, account reuse or another technique is not proven. WEDA labelled the cause as an external malicious act in the hacking, malware or phishing category for CNIL notification.","taken":"WEDA’s primary material says the API could call patient data stored in WEDA databases across customer boundaries. It instructs customer organisations to classify the affected category as patients and says the approximate number of records and persons remained under investigation. That supports a patient-data confidentiality-breach risk. It does not support inventing a national patient count. The 23,000 figure is the number of health professionals operationally affected by the shutdown.","notTaken":"No reliable public final total of affected patient records was found. The evidence does not establish mass export of all WEDA patient records. Local providers who later told their own patients that their specific practice had not identified health data as compromised should not be generalised into a claim that no WEDA patient data anywhere was accessed.","impact":"The outage immediately disrupted care workflows. Clinicians temporarily worked without normal electronic access to histories, prescriptions, correspondence and billing tools, sometimes reverting to paper and asking patients to bring recent documents. The confidentiality risk is unusually serious because the system stores health information. Even unauthorised access to a smaller subset of medical data can create significant privacy and discrimination risks.","response":"WEDA shut the service, disabled suspicious accounts, blocked source IP addresses, brought in forensic support, contacted ANSSI, filed a police complaint and supported CNIL notification. Before reopening, it reviewed Pro Santé Connect, tightened source-IP restrictions, decommissioned vulnerable endpoints, and restricted professional login to stronger healthcare authentication methods during the degraded recovery period.","methodDisclosure":"disclosed","revision":"An unspecified intrusion is too vague given WEDA’s later primary document. The public record now supports authenticated customer accounts used to call APIs, an API that could return patient data outside the customer’s own scope, and a confidentiality breach. The affected patient count still remains unknown.","quotes":[{"text":"an abnormal activity spike","original":"un pic d’activité anormal","originalLang":"fr","attribution":"WEDA CNIL-notification material","sourceId":"wedaCnil"},{"text":"loss of confidentiality","original":"Perte de la confidentialité","originalLang":"fr","attribution":"WEDA CNIL-notification material","sourceId":"wedaCnil"},{"text":"still under investigation","original":"toujours en cours d’investigation","originalLang":"fr","attribution":"WEDA CNIL-notification material","sourceId":"wedaCnil"}]}},"source":{"id":"wedaCnil","name":"WEDA — CNIL breach-notification guidance","url":"https://assistance.weda.fr/hubfs/2025-11_Notification%20violation%20CNIL%20WEDA.pdf","publisher":"WEDA","kind":"primary","published":"2025-11-12"},"sources":[{"id":"wedaCnil","name":"WEDA — CNIL breach-notification guidance","url":"https://assistance.weda.fr/hubfs/2025-11_Notification%20violation%20CNIL%20WEDA.pdf","publisher":"WEDA","kind":"primary","published":"2025-11-12"},{"id":"wedaCnilDirect","name":"CNIL — question on the WEDA breach notification","url":"https://www.cnil.fr/en/cnil-direct/question/2652","publisher":"CNIL","kind":"official","published":"2025-11-11"},{"id":"wedaLemonde","name":"Le Monde — WEDA cyberattack, paralysis and data leak","url":"https://www.lemonde.fr/pixels/article/2025/11/18/une-cyberattaque-contre-weda-logiciel-utilise-par-des-milliers-de-medecins-provoque-paralysie-et-fuite-de-donnees_6653915_4408996.html","publisher":"Le Monde","kind":"secondary","published":"2025-11-18"},{"id":"weda","name":"01net — WEDA medical-software attack","url":"https://www.01net.com/actualites/cyberattaque-inquietante-france-donnees-medicales-auraient-piratees-23-000-professionnels-sante-paralyses.html","publisher":"01net","kind":"secondary","published":"2025-11-18"},{"id":"wedaCaducee","name":"Caducee.net — WEDA, 23,000 health professionals","url":"https://www.caducee.net/actualite-medicale/16693/cyberattaque-weda-23-000-soignants-concernes.html","publisher":"Caducee.net","kind":"secondary","published":"2025-11-19"},{"id":"wedaAvec","name":"AVEC Santé Nouvelle-Aquitaine — WEDA guidance for practices","url":"https://avecsantena.fr/cyberattaque-du-logiciel-weda-que-sest-il-passe-et-comment-reagir-pour-une-msp/","publisher":"AVEC Santé Nouvelle-Aquitaine","kind":"secondary","published":"2025-11-17"}]}