Cerballiance Data Breach Exposes Patient Information Across France A major cybersecurity incident at Cerballiance, one of France’s largest medical testing networks, has compromised sensitive patient data, including personal identifiers, encrypted passwords, and in some cases, lab results and national ID numbers. The company, which serves 28 million patients annually across 600+ locations in France and its overseas territories, confirmed unauthorized access to patient records. ### What Data Was Exposed? The breach may have exposed: - Personal details (names, contact information) - Login credentials (emails and encrypted passwords) - Medical test results (in some cases) - French national ID numbers (equivalent to U.S. Social Security numbers), increasing risks of identity theft and phishing. ### How Are Patients Notified? Cerballiance is contacting affected individuals via email or text, though the messages may resemble phishing attempts. Patients who do not receive a notification are likely unaffected. To verify, individuals should use official channels: - Phone: 0800 95 27 27 (weekdays, 10 a.m.–12 p.m. and 2 p.m.–4 p.m. local time) - Email: [email protected] ### Immediate Risks & Recommended Actions - Password security: Affected users should change passwords, particularly for their email accounts, as compromised credentials could enable further attacks. - Phishing threats: Scammers may use leaked details to craft personalized phishing messages, such as fake refund notices or lab report alerts. Users should avoid clicking links and verify requests through official sources. - Two-factor authentication (2FA): Enabling 2FA adds an extra layer of security against unauthorized access. ### Regulatory & Legal Context Cerballiance reported the breach to France’s CNIL (the national data protection authority) and filed a complaint with law enforcement. Under GDPR, the company could face fines of up to €20 million ($22 million) or 4% of global revenue if found negligent. The incident also highlights vulnerabilities in third-party hosting providers, a growing concern in healthcare data security. The breach underscores the ongoing risks of targeted phishing and the need for heightened vigilance in verifying communications related to medical data.