Skip to content

French Medical Platform Follow Data Offered for Sale, Over 2 Million Patient Records Exposed

Breach Report France flagFrance Healthcare Data for Sale

French Medical Platform Follow Data Offered for Sale, Over 2 Million Patient Records Exposed

A threat actor using the alias Saturne is selling a database from Follow.fr, a French Ségur-certified medical software and patient-record platform used by specialist doctors and surgeons. The listing claims 2,052,123 patient records in CSV format, dated July 2026, described as a partial export interrupted by detection. Per the schema, each record includes patient names, sex, date of birth, email and phone numbers, French INSEE national identification numbers, health insurance numbers, and associated doctor details. The price is negotiable and samples are offered to serious buyers. The claim is unverified.

Data2,052,123 records
PriceNegotiable
CountryFrance flagFrance
ActorSaturne

Post details

TargetFollow.fr (medical / patient records)
CountryFrance flagFrance
SectorHealthcare
Claim2,052,123 patient records (CSV)
DataNames, INSEE, insurance, doctors
VectorMass export of patient lists
Observed
ActorSaturne

!Allegedly included

  • 2,052,123 patient records
  • Patient names (birth & used)
  • Sex & dates of birth
  • Email & phone numbers
  • INSEE national ID numbers
  • Health insurance numbers
  • Profession & labels
  • Associated doctor details

Screenshot

Potential impact

If genuine, this pairs patients' identities with French INSEE national identification numbers, health insurance numbers, and contact details across more than 2 million people, a combination that enables identity theft, insurance and healthcare fraud, and targeted phishing. Because the platform serves specialist doctors and surgeons, the records also link patients to their treating physicians, adding a sensitive medical dimension. INSEE numbers are core French identifiers and are not easily changed. No sample records, identifiers, download links, or the seller's contact channel are reproduced here. The claim is unverified.

iStatus

Unverified

This is a sale listing; the price is negotiable and samples are offered to serious buyers. No sample records, identifiers, download links, or the Session contact channel are reproduced here. This is the same alias behind other recent French and European leaks. The claim is unverified and Follow has not publicly addressed it.

Want everything on this breach, including the unblurred screenshots? Paid subscribers get the full claim details, breach URL, and more. Check out the threat feed, then after subscribing, search there for this alert. View pricing →

DARK WEB INFORMER - THREAT INTELLIGENCE

Latest