Publication date:
November 14, 2025 · breach disclosed on 26 November 2025
Itelis
France
Data sensitivity :
Critical
Health / medical facilities & laboratories
Exposed records :
Volume not disclosed; investigations indicate several years of optical reimbursement records may be affected.
Compromised data :
Identity data (name, birth date), national identification number, dossier number, health reimbursement information, visual correction data, phone number (limited cases); no banking data, postal address or email reported.
What happened?
Itelis, a healthcare network used for optical reimbursements, reported unauthorized access tied to the impersonation of a partner optician. Data of customers from Axa and Malakoff Humanis were exposed for claims processed between 2020 and 2022. The impact concerns sensitive health-related information and identifiers, with confidentiality risks and potential misuse for targeted fraud.
Tactics, Techniques and Procedures (MITRE ATT&CK ) :
Initial access via impersonation of a legitimate optical partner to access the reimbursement platform (T1656 – medium confidence; T1078 – medium confidence), followed by collection of health-related claim data stored in the system (T1213 – medium confidence), and exfiltration of extracted records through the partner interface (T1041 – medium confidence).
We Share!
We share verified data breaches and cyber intelligence insights to help organizations understand how attacks happen and strengthen their awareness.
0
%
of successful breaches start from publicly exposed assets.
We Protect!
We protect your business through attack surface audits and data leak investigations – uncovering exposed systems, compromised credentials, and leaked access keys before attackers do.
