The personal data of 80,000 French people from a French mutual insurance company hacked

Mutual Emoa is definitely struggling to secure its computer servers. Already pinned after a first data leak in March, Emoa Mutuelle du Var was again hacked in April. This is revealed by CheckNews from the Liberation site, which adds that the personal data of more than 80,000 members and ex-customers “were stolen to be sold to the highest bidder on cybercriminal platforms”.

The leak includes various personal information such as “surnames, first names, dates of birth, postal codes and – for more than a quarter of the database – email addresses of members of this mutual insurance company in the south of France”. We also learn that “nearly 3,000 victims see […] also their social security number disclosed”. For some victims, it is even “the photocopy of their passport or all of their bank details (RIB, IBAN, BIC) which are found in nature, thanks to links accessible in the stolen file”.

Some of this data had already been stolen in March, explains CheckNews. The company then informed “some victims” and the CNL, thus respecting the law. However, a second leak “wider and giving access to much more sensitive data” took place a month later. The mutual was unaware of the existence of this second leak, until Release inform him. Despite the promise to have “implemented, as a matter of urgency, the appropriate security measures”the same server would have been targeted. Note that Emoa Mutuelle du Var, which defines itself as a “proximity mutual” ; claims 65,000 members and more than 4,000 businesses and self-employed workers. However, the backdoor databases also contain information about people who are no longer affiliated.

What are the risks for customers and former customers?

Unlike member data, past customer information is likely to be out of date. Nevertheless, a lot of personal information remains current (surname, first name, date of birth, email address, postal code, etc.). They represent a gold mine for malicious users. The latter may use such data to carry out phishing attacksalso called phishing in English.

For members and ex-customers, there is a risk that their information will be used in scam campaigns. The latter will therefore have to be extra vigilant… and prepare for receive more spam than usual.