---
title: "Data breach at Malakoff Humanis"
description: "On 17 October 2026, a threat actor using the alias ChimeraZ claimed to have released a partial database linked to the website of the French social protection group Malakoff Humanis. The actor cites 16,556 records, about 40 MB in JSON format. Samples reviewed by FrenchBreaches reportedly contain name"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-10-17-malakoff-humanis
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-10-17
dateModified: 2026-10-17
---
# Malakoff Humanis

Data breach — Critical

On 17 October 2026, a threat actor using the alias ChimeraZ claimed to have released a partial database linked to the website of the French social protection group Malakoff Humanis. The actor cites 16,556 records, about 40 MB in JSON format. Samples reviewed by FrenchBreaches reportedly contain names, dates of birth, policyholder identifiers, case references, hospital care authorisation documents, reimbursement details and correspondence with claims-handling departments, along with partially masked bank details. The authenticity of the data, its exact origin (the group's own systems or a service provider) and the number of distinct people affected have not been confirmed.

Health information tied to an identity, together with case references and correspondence, could let a third party craft credible phishing messages impersonating the insurer or its claims-handling services.

| Fact | Value |
| --- | --- |
| Disclosed on | October 17, 2026 |
| Incident dated | October 17, 2026 |
| Sector | Insurance |
| Country | France |
| Cause | Undisclosed |
| Severity | Critical |
| Status | Reported |

## Exposed data

- Full name
- Date of birth
- Postal address
- Email address
- Customer ID
- Health data
- Banking data (IBAN, card)
- Other personal data

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- Watch your statements. On any unknown debit, block the card and request a refund — French law (art. L133-18) entitles you to it.
- Health data is “special category” data under the GDPR: a leak opens a right to compensation, and the organisation must notify the DPA within 72 hours.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Malakoff Humanis](https://frenchbreaches.com/alertes/malakoff-humanis-mvcsz2tmuezpml0e5j) — FrenchBreaches

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-10-17-malakoff-humanis
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees