On 12 November 2026, the medical appointment booking site 1001RDV was defaced by hackers who claim to hold the data of more than 9 million patients and are demanding a ransom. The publisher, Logicielnet, says only its showcase website was affected and that no patient database was accessed. Between a spectacular claim and a denial without technical detail, here is what has been established, what has not, and the right reflexes for patients and medical practices alike.
A hacked page and a 24-hour ultimatum
1001RDV lets people book an appointment with a doctor or dentist, online or by phone. The service is published by Logicielnet, part of the IPContact group, whose offering for practitioners also includes SMS reminders and a messaging tool for communicating with patients. According to Fuites Infos, the site’s pages were replaced on 12 November by a message from the attackers, together with a demand for $33,333 in cryptocurrency to be paid within 24 hours. The deadline fell on 13 November at around 1:20 pm Paris time. No data sample accompanied the threat.
The contact left on the page points, according to Fuites Infos, to an actor linked to 145 claims since April 2026, more than a third of which were later confirmed. The outlet notes, however, that this actor usually posts on forums rather than defacing websites: a third party may therefore have borrowed its identity.
What the hackers say they stole
The inventory of the claimed files was described by FrenchBreaches, which considers the claim credible without being able to confirm it. The attackers announce 22.7 GB spread across 2,686 files, including:
- a file of 9,016,504 patient rows, with name, date of birth, social security number, phone number, email and postal address;
- nearly 290 million appointment records, a total that does not represent as many different people, since the same patient may have several appointments;
- some 35 million messages exchanged with practices and 10 million call logs;
- practice staff accounts and hashed passwords coming, they say, from 75 servers.
As Clubic points out, citing FrenchBreaches, the 9 million figure comes solely from the hackers. The platform does not manage full medical records, according to its terms of use, and the attackers do not claim to have diagnoses or prescriptions. An appointment history nevertheless remains sensitive: it reveals which practitioner a person sees and how often.
Logicielnet’s denial, and its limits
In a written statement sent to Fuites Infos, Logicielnet explains that its showcase website, built on WordPress, was targeted by a cyberattack that made it temporarily unavailable. That site and its database are said to be separate from the business applications and patient databases. At this stage, its investigations have reportedly found neither unauthorised access to those databases nor exfiltration, but they are continuing. The publisher says it has fixed the vulnerability, is facing new flooding attempts and intends to file a complaint with the gendarmerie. The site was working normally again that same evening.
Fuites Infos points out that this denial comes from an interested party and specifies neither the vulnerability exploited nor where the business applications are hosted. The defacement proves that the attackers took control of a public page; it does not demonstrate access to health data, though it does not rule it out either. At the time of their publications, Clubic and FrenchBreaches had not obtained confirmation from the publisher.
Patients and practices: the right reflexes
Even if unconfirmed, this type of incident paves the way for targeted scams. A social security number cannot be changed, and a name linked to an appointment date is enough to write a convincing fake text message, announcing for example a cancellation or an unpaid bill. The recommendations relayed by Clubic are simple:
- when faced with an unexpected request, call the practice back on a number you already know before replying or paying anything;
- never send your social security number or login details in response to a message;
- use a unique password for your health accounts and enable two-factor authentication where available;
- check the access history in Mon espace santé.
For client practices, the issue is more direct, since the hackers say they hold staff login credentials. Immediately changing the passwords of 1001RDV accounts and asking the publisher about the measures taken is basic prudence. More broadly, the case is a reminder that an appointment booking provider concentrates the contact details of a very large number of patients.
Frequently asked questions
Are nine million patients really affected?
Nothing proves it at this stage. The figure comes from the hackers, no sample has been published and Logicielnet says its patient databases were not breached, while continuing its investigations.
Is my medical record affected?
According to its terms of use, 1001RDV does not store full medical records, and the hackers claim neither diagnoses nor prescriptions. They do, however, mention appointment histories and messages exchanged with practices.
What should I do if I receive a text message from a medical practice?
Do not click any link and do not pay anything without checking. Contact the practice using a number you already know; your social security number should never be given in reply to a message.
Sources
- 1001RDV : fuite de données revendiquée visant 9 millions de patients — Fuites Infos, 2026-11-12
- Des pirates disent détenir les données de 9 millions de patients d'une plateforme française de rendez-vous médicaux — Clubic, 2026-11-12
- Piratage de 1001RDV, les données médicales de 9 millions de patients menacées par des hackers — FrenchBreaches, 2026-11-12