On 12 November 2026, attackers defaced the website of 1001RDV, a French service for booking medical appointments. They claim to hold data on more than 9 million patients and demanded a ransom of $33,333 in cryptocurrency, payable within 24 hours. The publisher is Logicielnet, a company based in Meyreuil (Bouches-du-Rhône) that belongs to the IPContact group. It confirms that its WordPress marketing site was compromised. It denies that any patient database was accessed or that any data was taken. Only the defacement is confirmed. The 9 million figure comes only from the attackers. They have published no data sample, and no regulator notification has been made public.
What Happened
1001RDV lets patients book appointments with doctors, dentists and other practitioners, online or by phone. Logicielnet sells practices a wider set of tools alongside it: online calendars, SMS reminders, teleconsultation, remote secretarial services and patient messaging.
On 12 November, Fuites Infos reported that the site's pages had been replaced with a message headed "Hacked". In it, the attackers said they controlled the publisher's servers. The ransom deadline fell at about 13:20 Paris time on 13 November. By the evening of 12 November, the site was serving its normal pages again.
Fuites Infos reports that Logicielnet gave this account in a written statement:
- The marketing site, which runs on WordPress, was attacked and taken offline temporarily.
- That site and its database are isolated from the business applications and the patient databases.
- Investigations so far have found no unauthorised access to patient databases and no data exfiltration. The work is still under way.
- The vulnerability has been fixed. The company is dealing with continuing denial-of-service attempts and is preparing a complaint to the Gendarmerie nationale.
Attribution is unclear. Fuites Infos says the contact address on the defaced page points to an actor linked to 145 claims since April 2026, more than a third of which were later confirmed. The same outlet notes that this actor normally posts on forums and does not usually deface sites. It raises the possibility that someone else used the actor's name.
What Was Taken
Nothing has been confirmed as stolen. Logicielnet denies any patient data was exfiltrated. The list below is what the attackers say they hold, as relayed by FrenchBreaches, Clubic (cited by fuitededonnées.fr) and Fuites Infos:
- Volume: 22.7 GB across 2,686 files.
- Patient records: 9,016,504 rows. Reported fields include names, dates of birth, French social security numbers and phone numbers. Some reports also list postal addresses and email addresses.
- Appointment records: accounts of the size differ. Fuites Infos and Clubic report about 290 million appointment rows, while the FrenchBreaches alert lists 29 million. Clubic notes that the rows do not represent distinct people, because the same patients appear many times.
- Communications: about 35 million messages between patients and practices, and close to 10 million phone call logs, according to Clubic.
- Practice and staff credentials: accounts for practice staff, plus logins and hashed passwords that the attackers say came from 75 servers.
FrenchBreaches calls the claim "credible but unconfirmed". Clubic, citing Logicielnet's terms of use, reports that 1001RDV does not handle medical records. That means any real leak would be identity, contact and appointment data, not clinical files. Even so, a social security number tied to a name and date of birth is enough to support identity fraud. Appointment history can also reveal which specialists a person sees.
Why It Matters
- The two sides are far apart, and nothing has been independently checked. The only confirmed fact is a WordPress defacement. The attackers describe a full compromise of the backend. With no data sample and no technical detail in the denial, neither account can be verified yet. A record count is not proof of access. A denial is not proof that nothing happened.
- Booking platforms hold valuable data. A name, social security number, phone number and next appointment is exactly what a convincing phishing message needs. For example, a fake SMS "from your clinic" about a real upcoming appointment would be hard to spot.
- Claims cause harm even when they are false. Whether or not any data left the network, patients and practices will now receive scam messages that refer to the incident. Practices using 1001RDV should expect questions from patients and should be ready with a consistent answer.
- There is a pattern of reused names. If the named actor's identity was borrowed, attribution based on a contact address alone means little. Analysts should not count this incident toward that actor's record until more evidence appears.
The Attack Technique
Logicielnet says the attackers exploited a vulnerability in the WordPress marketing site at 1001rdv.com. It has not said which vulnerability, whether it was in a plugin, a theme or WordPress core, or how it was exploited. The publisher reports denial-of-service attempts that continued after the site was restored.
The attackers say they controlled 75 servers and took credential hashes. That would require lateral movement well beyond a marketing site. Logicielnet's position is that the WordPress site has no connection to the patient databases. The two accounts cannot both be fully true. No forensic findings have been released that would settle the question.
What Organizations Should Do
- Treat marketing websites as part of your attack surface. Keep WordPress core, themes and plugins patched. Remove unused plugins. Put a web application firewall in front of the CMS. Check that the website really has no network route or shared credentials leading to production systems, and test that separation rather than assuming it.
- Rotate shared and service credentials after any web compromise. The attackers claim to hold hashed passwords from many servers. Any organisation in a similar position should reset admin, database and API credentials and enforce MFA on staff accounts.
- Practices using 1001RDV should warn patients now. Tell them the practice will never ask for a social security number, payment or login details by SMS or email. Name the official channel patients should use to check any message.
- Watch for follow-up fraud. Monitor for phishing that copies your booking or reminder messages. Check unusual login activity on practitioner accounts.
- Write down what your investigation can prove. If you deny that data left your network, back the denial with log evidence such as database access logs and egress monitoring. Notify the CNIL within 72 hours if personal data exposure cannot be ruled out.
- Have a plan for responding to extortion. Agree in advance on ransom policy, legal reporting (for example a police complaint) and who speaks publicly, so that a 24-hour deadline does not force decisions.
Sources: 1001RDV: hackers claim data on 9 million patients, what we know | 1001RDV dément la fuite revendiquée visant 9 millions de patients —... | 1001RDV : une cyberattaque signalée contre la plateforme française... | Piratage de 1001RDV, les données médicales de 9 millions de patient... | 1001RDV : les données de 9 millions de patients revendiquées par de... | Cyberattaque dans la santé, des pirates revendiquent les données de... | 1001RDV : des pirates revendiquent 9 millions de patients, ce que l... | Piratas informáticos afirman tener los datos de 9 millones de pacie...