Data breach at MédecinDirect: when digital health forgets what matters most

The cyberattack that hit MédecinDirect, disclosed in early December, affects up to 323,000 patients. The number is already enormous. But that is not what should worry us the most.

The real problem is not that an attack happened.
It is what the attack reveals: a dangerous trivialisation of health data, treated as just another piece of digital information among many.

Yet it is nothing of the sort.

What happened

MédecinDirect is a telemedicine platform used by several French mutual insurers and supplementary health providers. It lets members consult doctors remotely, exchange medical documents, and obtain prescriptions or advice.

Following a computer intrusion, personal and medical data were exposed.
According to the information available, this reportedly includes identity data and contact details, but also elements linked to the care pathway.

And the insurers? And the authorities? Nothing. As usual.

Here too, we are firmly in familiar territory.

• The company communicates "transparently" but says nothing specific.
• The mutual insurers, the platform's partners, play for time.
• The State says it is "taking the matter seriously".
  But in the meantime, the data are already circulating. Perhaps for sale on forums. Perhaps in use. Perhaps being exploited.

On paper, the process is followed.

But in practice, one question remains: how can a health platform be compromised to this degree in 2025?

A cyberattack is not always an accident

Let us be clear: any organisation can be attacked.
No infrastructure is invulnerable.

But not all attacks are equal.

There is a fundamental difference between:

• a sophisticated attack against a well-protected system,
• and a compromise made possible by weak structural choices: poorly segmented access, insufficient monitoring, badly controlled technical dependencies.

In the field of health, this distinction is essential.
Because the impact is not financial.
It is human, intimate, lasting.

You can replace a payment card.
You cannot replace a medical history.

Why health data are a target of their own kind

Medical data are not merely sensitive.
They are persistent.

A diagnosis, a treatment, a past or present condition:
this information can be exploited years later, cross-referenced with other breaches, used for fraud, blackmail, manipulation or discrimination.

And contrary to a common assumption, these data are not used only for spectacular targeted attacks.
Above all, they feed a quiet underground market, where aggregating data is worth more than the isolated hit.

That is precisely why health platforms should be among the most rigorous systems in the country.

The real problem: trust delegated without oversight

In this affair, many patients are discovering that they were using MédecinDirect... without really knowing it.
The platform was built into their mutual insurer, their contract, their care pathway.

That is where the crux of the problem lies.

We have built a system in which:

• members trust their mutual insurer,
• mutual insurers trust technical providers,
• providers stack up digital solutions,
• and no one keeps a clear view of the chain of responsibility.

When everything works, no one asks questions.
When it breaks, everyone communicates.

But trust, by then, is already damaged.

What each of us can do, concretely

This is not about panicking, nor about sinking into blanket distrust.
But it is time to adopt a few simple, realistic habits.

If you have used a telemedicine service:

• Check whether you have an active account and change your access credentials.
• Ask your mutual insurer the question directly: which providers do they use for digital health?
• Separate your uses: an email address dedicated to medical services helps limit your exposure.
• Be wary of unexpected messages mentioning reimbursements, medical documents or urgent updates.

These steps do not make the system perfect.
But they reduce your personal exposure.

What the players should do (and are slow to do)

For companies and institutions, the subject runs deeper.

Cybersecurity in health can no longer be treated as a secondary technical matter, handed off to a provider or an isolated team.

It must be:

• driven at the governance level,
• built into architecture choices,
• tested regularly,
• accepted as a non-negotiable cost.

Not as a "bonus", not as a marketing argument.

Regulatory compliance (GDPR, health data hosting, certifications) is necessary.
But it is not enough if it is treated as an administrative formality.

What this affair reminds us, at heart

Digital health is a step forward.
But it has value only if it protects what it promises to make easier.

In Être en cybersécurité, I say it often:
security is not a matter of fear, but of clear sight.

This attack is not an anomaly.
It is a signal.

A reminder that the digital world, when it touches the intimate, demands something other than speed and innovation.
It demands discernment, responsibility, and a genuine culture of risk.

Without that, we will keep discovering the consequences... after the fact.