2024-02-10 10:11:43
Scams by email or SMS, misuse of allowance… After the hacking of the data of millions of French people, Le Figaro takes stock of the possible consequences of such an attack for users. What to do if you have been hacked?
It is a large-scale attack whose contours are difficult to discern. On Wednesday February 7, the CNIL lifted the veil on a massive data leak concerning two health operators, Viamedis and Almerys. “In total, this data leak concerns more than 33 million people”, details the CNIL in its press release. Friday evening, the Paris prosecutor’s office opened an investigation after complaints from the two service providers.
What data is concerned? For policyholders and their families: marital status, date of birth and social security number, name of health insurer as well as the guarantees of the contract taken out. “Neither banking information, nor medical data, nor health reimbursement, nor postal details, telephone numbers or even emails are concerned”, assured several mutual insurance companies in messages addressed to their customers. But what can hackers do with this data?
What can hackers do with our data?
“It’s as if the pirates had stolen keys or master keys,” analyzes Denis Jacopini, judicial expert in cybercrime. This data can now be resold or used by hackers on the same network for a return on investment. Several options are then available to scammers. “They may try to impersonate you to institutions or companies,” says the specialist. For example, the social security number is necessary to connect to your Ameli account. Once infiltrated into their victim’s account, scammers can divert allocations to their own bank accounts.
“Scammers can also pose as organizations and try to trick you,” adds Denis Jacopini. With data like name, date of birth and insurance contract details, a hacker can easily pose as a bank or insurance employee to extort money from users whose details have leaked . “With some well-chosen details, it is quite easy to gain the trust of certain people,” assures the cybersecurity specialist. “This personal information will make it possible to carry out very effective phishing campaigns, by email or SMS,” confirms Pierre Penalba, former head of the first group to fight against cybercrime of the National Police. Fake messages with all your contact details will appear larger than life.”
How to recognize a phone scam?
To prevent scams that could happen. Denis Jacopini recommends remaining on your guard. “If someone shows up on the phone as your bank or insurance advisor and asks you to do something unusual, it’s probably a scam.”, warns the expert. The safest way is to make a return call to the usual number or to a number listed on official documents. “This is the only solution to be sure to speak to the same person”insists Denis Jacopini.
How to recognize an email scam?
Hackers could also pretend to be your mutual or social security company by email, and ask you to click on a link or enter information to “get your refund” or “unblock your vital card”. A seemingly urgent request that pushes you to provide the requested information as quickly as possible, taking little time to think.
Health Insurance recommends “stay attentive to the sender of messages”. The address that sent the email could look like an official address, but there are often extra letters, hyphens… Generally speaking, it is better not to click on the link and go and connect yourself to his account: if something is really asked of us, it will appear in this space. Likewise, it is better to avoid opening attachments if the email seems suspicious.
Read alsoHow to thwart internet scams?
Will hacked people be informed?
Companies that have suffered data theft have an obligation to notify the people concerned. As Viamedis and Almerys are supplementary health providers, it is the latter who must notify their customers.
For her part, given the scale of the attack, the president of the CNIL decided to carry out investigations in order to determine in particular whether the security measures implemented prior to the incident and in reaction to it were appropriate. with regard to GDPR obligations. “How did the hackers manage to penetrate the company sites and why was the data not encrypted?,” asks Pierre Penalba. Everyone has the right to ask themselves the question.”
This Thursday, February 8, the Viamedis site, one of the two hacked operators, was suspended “so that it can be reopened under maximum safety conditions, as quickly as possible” according to the message on the home page.
1707562947
#recognize #email #scam