---
title: "Data breach at Centre Hospitalier Intercommunal des Alpes du Sud (CHICAS)"
description: "On 17 October 2026, an actor calling itself HXH – HAY X HACKER claimed to have compromised chicas-gap.fr, the website of the Centre Hospitalier Intercommunal des Alpes du Sud, which groups the Gap and Sisteron hospitals. The actor says it holds more than 3,327 files and records, about 1,000 case fil"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-10-17-centre-hospitalier-intercommunal-des-alpes-du
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-10-17
dateModified: 2026-10-17
---
# Centre Hospitalier Intercommunal des Alpes du Sud (CHICAS)

Data breach — Critical

On 17 October 2026, an actor calling itself HXH – HAY X HACKER claimed to have compromised chicas-gap.fr, the website of the Centre Hospitalier Intercommunal des Alpes du Sud, which groups the Gap and Sisteron hospitals. The actor says it holds more than 3,327 files and records, about 1,000 case files, including identity cards, passports, CVs, administrative documents, names, postal addresses and email addresses. An internal document dated February 2026, certifying a hospital practitioner's role, was shown as proof, which suggests the files relate to medical staff or job applications. The institution has not confirmed the incident, the entry point is unknown, and the actual content of the data has not been verified.

Copies of identity documents combined with names, addresses and professional details could facilitate identity theft, administrative fraud and targeted phishing.

| Fact | Value |
| --- | --- |
| Disclosed on | October 17, 2026 |
| Incident dated | October 17, 2026 |
| Sector | Healthcare |
| Country | France |
| Cause | Undisclosed |
| Severity | Critical |
| Status | Reported |

## Exposed data

- Full name
- Postal address
- Email address
- Identity document
- Employment data
- Other personal data

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [CHICAS de Gap : plus de 3 300 fichiers revendiqués dans une cyberattaque](https://www.cyberattaque.org/chicas-de-gap-plus-de-3-300-fichiers-revendiques-dans-une-cyberattaque/) — Cyberattaque.org

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-10-17-centre-hospitalier-intercommunal-des-alpes-du
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees