After 500,000 medical files were found in plain view on online forums, the Paris prosecutor's office opened a judicial investigation.
This was entrusted to the Central Office for the Fight against Crime Related to Information and Communication Technologies (OCLCTIC).
The two charges are "fraudulent access and maintenance in an automated data processing system" and "fraudulent extraction, possession and transmission" of the pirated data.
An investigation was also launched by the CNIL on Wednesday, in order to determine the failings at the origin of this medical data leak.
A case of "
particular gravity
", according to Louis Dutheillet de Lamothe, secretary general of the national commission for data processing and freedoms.
A leak reported as early as November 2020
According to a survey conducted by Liberation, the data would come from several laboratories located in the north-western quarter of France.
These medical centers have one thing in common: the use of a software for entering medical-administrative information published by the Dedalus group.
The data contained in these documents would be particularly sensitive, in particular comments on the state of health of the patients: potential pregnancy, drug treatments, or pathologies such as HIV.
Data worth gold, the file would have a value of "
2000 to 3000 euros
", according to David Sygula, cybersecurity expert for CybelAngel.
Read also: The Cnil investigates after the leak of hundreds of thousands of French medical data
Yet in this case, the files were published free of charge, an element which suggests that they have "
already been used
" according to the expert.
This reasoning coincides with a statement from the National Information Systems Security Agency (Anssi) which told AFP that it had identified the “
origin
” of the health data leak, and reported it at the Ministry of Health from November 2020.