Loading story…
CERT-FR and CERT Santé have warned that recurring critical vulnerabilities in software deployed by French healthcare organizations threaten medical-data confidentiality, continuity of care and patient safety. Their joint report documents anonymized cases involving exposed secrets, administrator credentials embedded in application code, SQL injection, cross-site scripting, unauthenticated internet-facing services and broken access controls. The report highlights active exploitation of authorization flaws in healthcare SaaS platforms after attackers compromise professional accounts through phishing or credential stuffing, enabling access to other users’ or organizations’ data. Widespread use of affected products creates the potential for attacks against many healthcare providers simultaneously.
Vendor remediation remains a major obstacle: an Agence du numérique en santé survey found that 74% of respondents had encountered vendors that delayed or refused fixes. Vulnerability handling exceeded a year at four major vendors, and final patch deployment for one medium-severity flaw was scheduled five years after disclosure. Despite improving vendor engagement and transparency, the CERTs consider observed security practices inadequate and recommend robust authentication and least-privilege access, rather than weakening protections to accommodate customer requests. Healthcare organizations should review internet exposure and vendor remediation commitments. The report also highlights Cyber Resilience Act vulnerability-reporting requirements applicable since September 11, 2026, ahead of full application in December 2027, with potential penalties reaching €15 million or 2.5% of worldwide annual turnover.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
CERT Santé handled 400 malicious incidents during 2025, approximately 22% more than in 2024.
CERT Santé handled 328 malicious incidents during 2024, establishing the baseline for the subsequent increase in its annual incident workload.
CERT Santé and CERT-FR published report CERTFR-2026-CTI-007 using anonymized real-world cases to expose recurring healthcare software vulnerabilities and remediation failures. They urged vendors and healthcare organizations to implement robust authentication and least-privilege access, warning of risks to health-data confidentiality, continuity of care, and patient safety.
The report describes particularly active exploitation of authorization vulnerabilities in healthcare SaaS solutions. Attackers compromised professional accounts through phishing or credential stuffing, then used authorization flaws to expand access to data.
CERT Santé and CERT-FR identified readily internet-exploitable vulnerabilities in multiple healthcare solutions, including exposed secrets and administrator credentials, SQL injection, cross-site scripting, and unauthenticated services. Broken access controls also allowed account holders to access other users’ or healthcare establishments’ data.
An Agence du numérique en santé survey found that 74% of respondents had encountered vendors that delayed or refused vulnerability fixes. It also found that 82% of healthcare establishments had become aware of vulnerabilities during the preceding 12 months and 90% lacked a formal vulnerability-reporting channel to vendors.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourcecyberveille.ch
Open sourcecert.ssi.gouv.fr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Healthcare organizations remain under sustained cyber pressure, with **764 incidents reported in 2025** versus 749 the previous year, according to French health-sector reporting cited by *ZDNet*. A national survey of healthcare executives found that **15% of facilities** said they had experienced a cyber incident causing disruption since 2022, while leadership concerns in a crisis center on **continuity of care**, financial impact, and staff working conditions. The reporting indicates cyber risk is now treated as a governance issue rather than only a technical one, but resource constraints and the need to strengthen hospital information systems remain major obstacles. Germany’s **BSI** separately warned that software security in the healthcare sector is still inadequate after testing standard configurations of several medical and practice-management applications. In that review, **three of four** examined practice management systems contained chains of weaknesses that could have enabled **internet-based attacks**, including the use of outdated encryption algorithms; vendors were notified and reportedly remediated the issues. A separate *ZDNet* article about manipulation of online payment flows at Spanish hotels concerns a **different incident** in the payment sector and is not part of the healthcare story.
Jun 29, 2026
French healthcare software provider **Cegedim Santé** confirmed a major breach affecting its *MonLogicielMedical (MLM)* product after unusual activity was detected in late 2025. The incident exposed administrative data tied to roughly **1,500 doctors** (out of ~3,800 users) and patient data at large scale—reported as **15.8 million records**, including **165,000 files** that may contain doctors’ notes; while structured medical records were reported as intact, some administrative comments may include sensitive clinical notes and highly sensitive details (e.g., HIV/AIDS status or sexual orientation). Cegedim Santé reported notifying French authorities including **CNIL** and filing a complaint. In the US, **Cornerstone Specialty Hospitals** agreed to a **$2.35M** class-action settlement tied to a **December 2023** network intrusion that ultimately affected **484,957 individuals**, with potentially exposed data spanning identifiers (including SSNs and government IDs), financial data, credentials, and health/insurance information; the suit also alleged delayed notification (letters mailed around July 2024). Separately, **PIH Health** began notifying patients about a **December 2024 ransomware attack** that disrupted multiple hospitals and services; investigators concluded the attacker had network access from **Nov 14–Dec 23, 2024**, and after a prolonged review PIH Health confirmed in **Dec 2025** that patient information was present in files on compromised systems and may have been accessed or acquired, with notification letters prepared by **Feb 25, 2026** amid claims of large-scale data theft and some data leakage online.
Jun 29, 2026
A recent security posture report on the biotech sector has revealed that attackers can access sensitive health data with minimal effort, often requiring less than two hours per company to uncover critical vulnerabilities. Researchers found that APIs were the most prevalent weakness, accounting for 34% of identified issues, with many endpoints exposing personal information such as patient IDs, genetic reports, and partner data without authentication. Publicly accessible developer documentation, including Swagger and GraphQL introspection, allowed for comprehensive mapping of API surfaces, further increasing the risk of unauthorized access. More than half of the companies examined leaked internal system details through verbose error messages, exposed configuration files, or non-minified JavaScript, which included sensitive information like usernames, user IDs, file paths, and backend framework details. In some instances, hardcoded secrets such as API keys and private tokens were visible in frontend code, and verbose errors revealed stack traces and server internals, making it easier for attackers to identify exploitable weaknesses. Additionally, around 36% of companies had corporate credentials discoverable through public sources, often due to prior third-party breaches and stealer logs, highlighting the widespread issue of credential reuse. These exposed credentials, sometimes numbering 15 or more per company, could facilitate credential stuffing or account takeover attempts. The broader healthcare sector continues to face significant challenges, with breaches costing organizations an average of $398 per exposed record and $7.42 million per incident, the highest across all industries. The number of healthcare providers reporting losses over $200,000 quadrupled between 2024 and 2025, and 12% of providers suffered losses exceeding $500,000, double the average across all industries. The largest contributors to breach costs include detection and escalation, lost business, and post-breach responses, with many organizations raising prices to offset these expenses. Financial gain remains the primary motive for attackers in 90% of healthcare breaches, but espionage is increasingly significant, accounting for 16% of cases, partly due to geopolitical tensions such as the Russia-Ukraine war. Nearly half of healthcare organizations have experienced at least one cybersecurity incident in the past year, underscoring the sector's vulnerability. In 2024 alone, there were 1,710 reported data breach incidents in healthcare, with 1,542 confirmed cases compromising data integrity, confidentiality, or availability. The combination of technical weaknesses in biotech platforms and the high value of healthcare data continues to make the sector a prime target for cybercriminals. The findings highlight the urgent need for improved security fundamentals, including better API protection, credential management, and internal system hardening. Without significant improvements, healthcare and biotech organizations will remain at high risk for data breaches and associated financial and reputational damage. The report serves as a call to action for the industry to address these persistent vulnerabilities and adopt more robust cybersecurity practices. Proactive measures are essential to protect sensitive patient data and maintain trust in healthcare and biotech services. The ongoing trend of increasing breach frequency and cost demonstrates that current security measures are insufficient to counter evolving threats. Organizations must prioritize security at every level, from application development to employee credential management, to mitigate the risk of future incidents.
Jun 29, 2026