---
title: "Data breach at SDIS 66 (Service départemental d'incendie et de secours des Pyrénées-Orientales)"
description: "SDIS 66, the fire and rescue service of the Pyrénées-Orientales department, confirmed it was the victim of a data theft from a server maintained by a technical provider. A hacker using the alias \"Syrv4x\" claimed on September 30, 2026, on a cybercrime forum, to hold 118,892 records and 99,108 documen"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-30-sdis-66-service-departemental-d-incendie
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-30
dateModified: 2026-09-30
---
# SDIS 66 (Service départemental d'incendie et de secours des Pyrénées-Orientales)

Data breach — Critical

SDIS 66, the fire and rescue service of the Pyrénées-Orientales department, confirmed it was the victim of a data theft from a server maintained by a technical provider. A hacker using the alias "Syrv4x" claimed on September 30, 2026, on a cybercrime forum, to hold 118,892 records and 99,108 documents and images drawn from rescue intervention reports filled out by firefighters. The exposed material reportedly includes identities, contact details, dates of birth, medical assessments, intervention reports, and copies of national ID cards and health insurance cards. The exact number of distinct individuals affected is not established by the sources.

The combination of ID documents, health insurance cards and medical data enables particularly credible identity theft and exploitation of sensitive medical information.

| Fact | Value |
| --- | --- |
| Disclosed on | September 30, 2026 |
| Sector | Public sector |
| Country | France |
| Cause | Third-party provider |
| Severity | Critical |
| Status | Confirmed |

## Exposed data

- Full name
- Phone number
- Postal address
- Date of birth
- Identity document
- Social security number
- Health data

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- Health data is “special category” data under the GDPR: a leak opens a right to compensation, and the organisation must notify the DPA within 72 hours.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [SDIS des Pyrénées-Orientales](https://frenchbreaches.com/alertes/sdis-des-pyr-n-es-orientales-muofwgorb7tkmw3yu9a) — FrenchBreaches
- [SDIS 66 : fuite de données revendiquée sur des interventions de secours](https://fuitesinfos.fr/article/2026-09-30-sdis-66) — Fuites Infos
- [Le SDIS 66 victime d'une fuite de données](https://www.ici.fr/infos/faits-divers-justice/le-sdis-66-victime-d-une-fuite-de-donnees-7983412) — ICI
- [SDIS 66 : 118 892 interventions et près de 100 000 documents médicaux revendiqués par un hacker](https://www.cyberattaque.org/sdis-66-118-892-interventions-et-pres-de-100-000-documents-medicaux-revendiques-par-un-hacker/) — Cyberattaque.org
- [Le SDIS 66 victime d'une fuite de données](https://www.titrespresse.com/23516752603/sdis-victime-fuite) — Titres Presse

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-30-sdis-66-service-departemental-d-incendie
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees