Security Incident

Frequently Asked Questions

What data may be affected?

At this stage of the investigation, the categories of data potentially affected are as follows:

• identification and contact information (email address and phone number). Passwords, which are stored in encrypted form, are not affected by this incident. As a general precaution, you may nevertheless change your password;
• civil status data, residential address, and social security number when it has been provided;
• vaccination data and health profile information, where such a profile has been completed. This data is stored in coded form. At this stage of the investigation, we have not identified any direct exposure of medical information in plain text;
• no banking information is affected by this incident.

Who is affected?

We are not currently able to identify with certainty which individuals are affected. As a precautionary measure, we consider that all holders of a Digital Vaccination Record may potentially be affected by this incident.

What should I do?

We recommend that you remain particularly vigilant regarding unusual emails, text messages, or phone calls requesting personal, medical, or financial information.

If in doubt, do not disclose any sensitive information and always verify the identity of the person contacting you.

As a general precaution, you may also change your password.

Has the incident been reported to the CNIL?

Yes. In accordance with our regulatory obligations, the CNIL (French Data Protection Authority) was notified of this incident on June 15, 2026.

Has a complaint been filed?

Yes. A complaint has been filed with the competent authorities.

Do I need to file an individual complaint?

An individual complaint is not necessary unless you have suffered direct harm or become aware of an attempt to fraudulently use your data.

Are the services still available?

Yes. The Colibri software, the Digital Vaccination Record, and the Professional Digital Vaccination Record remain accessible and fully operational.

The security measures implemented following the incident have not resulted in any service interruption for users.

What are the risks associated with this incident?

Unauthorized access to personal data may, in some cases, lead to attempts by third parties to misuse that information. In particular, we encourage you to remain alert to the following situations:

• phishing attempts via email, text message, or telephone;
• unsolicited commercial communications;
• in rarer cases, attempts at identity theft.

How can I reduce the risks?

Be cautious of unusual messages, especially those asking you to provide personal, medical, banking information, or copies of identity documents.

Do not click on suspicious links and never disclose sensitive information following an unsolicited message or phone call. If in doubt, contact the organization concerned directly using its official contact details.

For any questions or assistance, you may also consult the official platform cybermalveillance.gouv.fr

What are you doing in practice to protect us?

As soon as this incident was discovered, we immediately implemented measures to contain the event, secure our systems, and prevent any further unauthorized access.

The main actions taken are as follows:

• comprehensive audit of our infrastructure and verification of the integrity of our environments;
• complete rebuild and modernization of our production environment;
• remediation of identified vulnerabilities and deployment of new security mechanisms;
• migration of our development tools to a new software forge meeting enhanced security and resilience requirements;
• redesign of our deployment processes to better isolate development and production environments and strengthen the protection of our infrastructure;
• strengthening of authentication mechanisms and access rights management;
• enhanced isolation of processing workflows and technical environments.

In addition, several initiatives are underway to further strengthen our security posture over the long term:

• strengthening security audits and penetration tests carried out by specialized providers;
• review and reinforcement of our internal procedures for access management, permissions, and workstations;
• continuing the modernization of our architecture and security practices to sustainably reduce the risk of a similar incident occurring again.

The principles governing the protection of personal data are described in our legal notice and our Privacy Policy.