---
title: "Data breach at Hôpital Paris Saint-Joseph"
description: "A hacker using the alias weykofa published three files on September 19, 2026 on a cybercriminal forum, presented as coming from Hôpital Paris Saint-Joseph in Paris. The main file contains about 15,060 distinct patient identifiers linked to names, email addresses and a history of payments made to the"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-19-hopital-paris-saint-joseph
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-19
dateModified: 2026-09-19
---
# Hôpital Paris Saint-Joseph

Data breach — Critical

A hacker using the alias weykofa published three files on September 19, 2026 on a cybercriminal forum, presented as coming from Hôpital Paris Saint-Joseph in Paris. The main file contains about 15,060 distinct patient identifiers linked to names, email addresses and a history of payments made to the hospital, with the last four digits of a bank card shown for a limited number of records. A second file claims data on 738 doctors (names, specialties, departments, some professional email addresses), part of which may come from the hospital's public directory. The hospital has not publicly confirmed the incident, and no CNIL notification has been identified so far.

The combination of a patient identifier, identity, email address and payment history makes targeted phishing attempts impersonating the hospital more credible.

| Fact | Value |
| --- | --- |
| Disclosed on | September 19, 2026 |
| Accounts affected | 15,060 |
| Sector | Healthcare |
| Country | France |
| Cause | Undisclosed |
| Severity | Critical |
| Status | Confirmed |

## Exposed data

- Email address
- Full name
- Customer ID
- Order history
- Banking data (IBAN, card)
- Employment data

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- Watch your statements. On any unknown debit, block the card and request a refund — French law (art. L133-18) entitles you to it.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Hôpital Paris Saint-Joseph](https://frenchbreaches.com/alertes/h-pital-paris-saint-joseph-mu93cn8lvv9l381ye9f) — FrenchBreaches
- [Hôpital Paris Saint-Joseph : les données de plus de 15 000 patients en fuite](https://www.cyberattaque.org/hopital-paris-saint-joseph-cyberattaque/) — Cyberattaque.org
- [Hôpital Paris Saint-Joseph : une archive revendiquée expose 15 044 patients, sans aucune donnée médicale](https://fuitesinfos.fr/article/2026-09-19-hopital-paris-saint-joseph) — Fuites Infos

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-19-hopital-paris-saint-joseph
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees