A week after Jean Castex, President Emmanuel Macron in turn saw his QR Code vaccination broadcast on social networks in recent days.
A leak that raises the question of possible fraud and questions the security of our personal data.
According to the Élysée, the origin of this incident would come from “health professionals who, through malice or negligence, circulated this data”.
The caregivers behind this leak "have been identified" and a referral to their professional orders "is in progress," said Health Insurance.
Because in reality, any health professional can a priori have access to the file of each person vaccinated, provided they have some information.
“You can easily retrieve the social security number with just a person's name and date of birth.
Then, you can then consult your vaccination record containing the famous QR code with this security number, ”explains general practitioner Michaël Rochoy.
Read also Macron's QR code online: data protection, sanctions for perpetrators ... a leak that questions
Problematic access?
Not necessarily, believes the deputy (LREM) of Côtes-d'Armor Éric Bothorel.
"It does not seem silly to me that a health professional can access health data, it is desirable and it makes their task much easier", judges the elected official.
An opinion that contrasts with that of Matthieu Dierick, expert in cybersecurity.
“When entering information into a database, there are rules to follow.
In this type of case, each caregiver should have been able to enter data, without being able to consult those already present.
However, the design of this base did not allow this.
The problem is all there: one can as well seize as to consult ”, laments the specialist, considering that“ everyone can thus be the object of a fraud via his QR Code ”.
Limited consequences
However, the consequences of such theft seem limited. People who have a spoofed QR Code can in theory use it to go to a restaurant or a movie… but no more. "With a name, a date of birth, the vaccine used and the date of vaccination, a priori there is nothing to set up very elaborate scams, nor to disturb geopolitical balances", smiles Eric Bothorel. But if the risk remains minimal for the individual, it may ultimately prove to be "problematic from a health point of view", nuances the cybersecurity expert who recalls that a "black market for QR Code is already in place. square ".
If in doubt of a possible fraud, any vaccinated person can generate a new QR Code on the Health Insurance website. At the same time, the government is considering the possibility of “canceling” the first QR Code obtained, in order to avoid any usurpation.
