10 November 2025
Weda
Company Healthcare
WEDA’s own material prepared to help customers complete CNIL breach notifications states that monitoring detected an abnormal activity spike at 17:00 on 10 November 2025 on a customer account making many API calls. Once a user was authenticated to a WEDA customer account, the API could return patient data even when those patients were not attached to that healthcare professional’s account.
Around 23,000 health professionals lost normal access when WEDA shut the application at 23:00. That figure is operational lockout, not a patient count. WEDA classified the event as a confidentiality loss and listed patients as the affected category, while stating that the approximate number of records and people was still under investigation.
Dated facts in the public record
17:00: abnormal API activity on a customer account. A second account shows the same pattern around 21:00. At 23:00 WEDA shuts the application for all users.
CNIL says it has been informed of the WEDA data breach from this date.
WEDA mobilises forensic support, files a complaint with the Police nationale, and begins exchanges with ANSSI.
Partial access resumes. Login plus password alone is no longer sufficient; Pro Santé Connect or CPx is required, and vulnerable endpoints are decommissioned.
How it happened
The suspicious activity came through authenticated customer accounts. The relevant API had an authorisation-boundary problem: a connected customer account could query patient data not attached to that professional. That is a failure of authorisation after a valid session, not merely an unspecified server intrusion. The material does not establish how the attacker obtained control of the customer accounts — phishing, credential stuffing, account reuse or another technique is not proven. WEDA labelled the cause as an external malicious act in the hacking, malware or phishing category for CNIL notification.
What was exposed
WEDA’s primary material says the API could call patient data stored in WEDA databases across customer boundaries. It instructs customer organisations to classify the affected category as patients and says the approximate number of records and persons remained under investigation. That supports a patient-data confidentiality-breach risk. It does not support inventing a national patient count. The 23,000 figure is the number of health professionals operationally affected by the shutdown.
What was not in scope
No reliable public final total of affected patient records was found. The evidence does not establish mass export of all WEDA patient records. Local providers who later told their own patients that their specific practice had not identified health data as compromised should not be generalised into a claim that no WEDA patient data anywhere was accessed.
What it meant in practice
The outage immediately disrupted care workflows. Clinicians temporarily worked without normal electronic access to histories, prescriptions, correspondence and billing tools, sometimes reverting to paper and asking patients to bring recent documents. The confidentiality risk is unusually serious because the system stores health information. Even unauthorised access to a smaller subset of medical data can create significant privacy and discrimination risks.
What was done next
WEDA shut the service, disabled suspicious accounts, blocked source IP addresses, brought in forensic support, contacted ANSSI, filed a police complaint and supported CNIL notification. Before reopening, it reviewed Pro Santé Connect, tightened source-IP restrictions, decommissioned vulnerable endpoints, and restricted professional login to stronger healthcare authentication methods during the degraded recovery period.
What later reporting changed
An unspecified intrusion is too vague given WEDA’s later primary document. The public record now supports authenticated customer accounts used to call APIs, an API that could return patient data outside the customer’s own scope, and a confidentiality breach. The affected patient count still remains unknown.
In their words
an abnormal activity spike
Original un pic d’activité anormal
WEDA CNIL-notification material
loss of confidentiality
Original Perte de la confidentialité
WEDA CNIL-notification material
still under investigation
Original toujours en cours d’investigation
WEDA CNIL-notification material
What does this mean?
- Phishing
- A message or call that imitates a real organisation to get you to hand over a password, a code or a payment.
- Credentials
- A username and password pair, or the equivalent key an application uses to log in.