French Grand Est e-health platform Pulsy breached; ~5 million patient identity records offered on dark web

According to DSIH, Pulsy, the Grand Est regional e-health operator, was attacked on June 18, 2026, leading to exfiltration of about 5 million rows of patient administrative data including names, sex, birth dates and the national health identifier INS ^[1]. According to L'Est Républicain, Pulsy said no medical data was involved; according to DSIH, the data was put up for sale on the dark web, phishing posing as health insurance agents has been reported, and Pulsy notified the CNIL, filed a complaint and enforced strong authentication from July 1 ^[2][1]. Pulsy urges affected people to be vigilant about unusual requests and never give passwords, security codes or bank details after an unexpected call, text or email ^[2].

Industries mainly affected: Healthcare

1. Be vigilant about unusual contacts claiming to be health insurers or care providers ^[2].
2. Never give passwords, security codes or bank details after unexpected calls, texts or emails .