2026 Ameli.fr — provider registry forum claim (unverified); ~12M alleged
Data compromised
Actor-claimed ~12M provider-directory rows: PP/RPPS-style professional IDs, names, specialties, SIRET/SIREN/FINESS, clinic addresses, phone/fax/email—structured Annuaire Santé–style fields, not attested patient insurance or DMP records
Technical writeup
Unverified forum database claim — indexed June 10, 2026. DarkForums user Cryptix posted a 2.29 GB listing branded "Ameli.fr Medical Registry Data Leak 2026" with ~12M healthcare provider/professional registry entries (PP identifiers, specialties, SIRET/SIREN/FINESS, clinic contact fields). Visible sample rows use obvious placeholders (e.g. DURAND/Alex, [email protected]) and a forum reply labeled the material "Fake data"; Cryptix was later banned for selling in the databases forum. OSINT monitors (MonThreat, DailyDarkWeb) and security blogs flagged the thread, but CNAM/Ameli published no matching breach notice at catalog time. Analysts note the schema matches France's public Annuaire Santé professional directory and may be repackaged open registry data rather than a fresh Ameli portal intrusion—distinct from the early-June LxM actor claim on patient/DMP data (ameli-france-lxm2026) and from January 2026 MOAB compilation rows that included ~9.2M RPPS-style professional mirrors.
Root cause
Unverified DarkForums database listing by poster Cryptix marketing an Ameli.fr healthcare provider/professional registry dump—CNAM and Ameli had not confirmed at catalog time