Assistance Publique-Hôpitaux de Paris

Assistance Publique-Hôpitaux de Paris (AP-HP), known as Paris Hospitals, is the public hospital system serving the Paris region in France. Its core function is the provision of public healthcare services, which includes operating numerous hospitals and medical facilities across the capital. A key aspect of its operational scope involves managing sensitive patient health information, including data generated from public health initiatives such as COVID-19 testing. The organisation processes and transmits this data to relevant health authorities, utilising designated digital platforms for secure file sharing to support contact tracing and epidemiological efforts. This role places AP-HP as a critical entity in the regional public health infrastructure, handling vast quantities of personal and medical information.

A defining and publicly documented attribute of AP-HP is its experience with a significant cybersecurity incident. In September 2020, the organisation suffered a data breach where attackers exfiltrated personal information of approximately 1.4 million individuals who had undergone COVID-19 testing in the Paris region. The compromised data included identities, social security numbers, contact details, and test results. The intrusion specifically targeted a secure file-sharing service AP-HP used to transmit contact tracing information to health authorities, rather than breaching broader national testing databases. This incident underscores the organisation's handling of highly sensitive data and the specific security challenges associated with third-party data transmission services. The breach prompted individual notifications to affected parties and triggered formal investigations by French data protection and cybersecurity agencies, with the health ministry filing a complaint to examine the breach's origins, consequences, and preventive measures. This event highlights AP-HP's position within the healthcare sector as a custodian of critical public health data, subject to stringent regulatory scrutiny and the persistent threat of cyberattacks targeting medical information.