Incident Overview

A threat actor using the handle HexDex is claiming to sell personal information belonging to 116,122 individuals from Santeo.net, a French online health insurance and mutual comparison platform operated by the brokerage company CAPIFINANCE. The service has been around since 1992, helping users compare and get quotes on health insurance and complementary coverage plans across different providers.

The dataset allegedly spans records from 2001 through 2026 and includes 102,236 unique email addresses and roughly 100,000 unique phone numbers. Beyond basic contact information, the listing details a wide range of fields — full names, dates of birth, home and mobile phone numbers, physical addresses with postal codes and cities, as well as insurance-specific data like policy company names, monthly premiums, coverage options, signature dates, and the agents who handled the accounts.

A sample line included in the listing shows JSON-formatted records with detailed policy information, including insurance provider names, offer descriptions, and production dates. A 1,000-record sample file is available for download. The threat actor is accepting offers via qTox and Session, with no fixed asking price listed.