13 August 2026
Santé publique France contractor
Government Public health
Santé publique France confirmed on 13 August 2026 that a contractor-hosted platform used to order public-health prevention materials had been attacked. The affected service, moncoupon.santepubliquefrance.fr, operates separately from the agency’s other sites and systems.
About 80,000 contact records were affected. The database was used to ship ordered materials and contained email addresses, postal addresses and telephone numbers. This is a public-health-sector breach, but not a breach of medical records.
Dated facts in the public record
An online claim about the platform appears, according to incident reporting.
Santé publique France confirms that a contractor-operated ordering platform has been attacked and that about 80,000 contact records are concerned.
How it happened
The affected service was a separate contractor-hosted platform used for ordering prevention materials. Santé publique France said it was independent of the agency’s other websites and systems. The initial access path was not disclosed. Posts attributed to the attacker described administrator access and use of an export function; those details are an attacker account, not an official technical finding.
What was exposed
Contact and delivery fields such as email, postal address and telephone number. Reporting on samples also referred to professional role or organisation for some records. The agency-confirmed scale is approximately 80,000 people.
What was not in scope
Santé publique France said there were no medical records, diagnoses or social-security numbers in the affected database. The platform was separate from the agency’s other systems.
What it meant in practice
The biggest practical risk is health-themed impersonation. Victims may be more likely to trust a message that knows their contact information and refers to a real prevention-material order or Santé publique France context. The brand association can amplify phishing even without clinical data.
What was done next
The platform was taken into maintenance, passwords were cleared, the CNIL was notified and restoration work began. Public communications emphasised that no health or social-security data was present and warned about follow-on fraud.
What later reporting changed
The case was only days old at the 16 August research cutoff. Method, contractor root cause and any later law-enforcement result remain open. Attacker claims of administrator access and an export function stay labeled as claims.
In their words
no health data
Original aucune donnée de santé
Santé publique France, reported by French press, 13 August 2026
What does this mean?
- Phishing
- A message or call that imitates a real organisation to get you to hand over a password, a code or a payment.