FHF Directory Leak Exposes 30,000 Healthcare Records | Femto Security Threat Intelligence

Key Takeaways

An alleged database breach at Fédération Hospitalière de France has exposed the contact details of 30,728 healthcare professionals.
Exposed fields include user IDs, names, emails, direct phone lines, and membership statuses, creating a high-risk landscape for social engineering.
No patient medical records were compromised in this leak, which was posted on the underground forum pwnforums.st.

Original source screenshot for FHF Directory Leak Exposes 30,000 Healthcare Records — Original source screenshot - pwnforums.st

Incident Severity Assessment

The directory breach leaks contact information of 30,000+ French healthcare leaders, escalating the risk of spear-phishing.

0.0

/ 10.0 custom

High Risk

FHF Exposure Statistics

Exposed Records

Represented Hospitals

FHF Directory Attack Sequence

1Asset Scanlow
Recon on subdomains/portals
low
2Initial Accesshigh
SQL Injection or Credential Stuffing
high
3DB Queryinghigh
Extraction of user table metadata
high
4Local Staginglow
Creation of CSV/JSON flat files
low
5Exfiltrationmedium
Egress over HTTPS web traffic
medium

MITRE ATT&CK Mapping for FHF Leak

Initial Access

T1190

Exploit Public-Facing Application

T1078.003

Valid Accounts: Local Accounts

Discovery

T1046

Network Service Discovery

Credential Access

T1110

Brute Force

Collection

T1213

Data from Information Repositories

T1074

Data Staged

Exfiltration

T1567

Exfiltration Over Web Service

Indicators of Compromise

domain
fhf.fr
Primary target domain
domain
fhf.fr
Primary target domain
domain
etablissements.fhf.fr
FHF directory/portal subdomain
domain
etablissements.fhf.fr
FHF directory/portal subdomain
ip
188.130.44.0/24
Associated network range
ip
188.130.44.0/24
Associated network range

How to Defend Against Similar Threats

Enforce a mandatory password reset and invalidate all active sessions across FHF portals and related platforms.
Warn all affiliated medical and administrative personnel about elevated risks of spear-phishing and vishing attempts referencing their FHF details.
Audit web application logs and database queries for anomalous access patterns, specifically looking for bulk exports of user data.
Deploy robust Web Application Firewall (WAF) filters to prevent SQL injection and unauthorized API querying on directory endpoints.

Threat Intel FAQ

What data was exposed in the Fédération Hospitalière de France (FHF) breach?

The leaked database includes 30,728 records containing user IDs, civility markers, first and last names, direct phone lines, email addresses, and membership statuses of hospital directors, partners, and medical professionals associated with the FHF network.

Are patient electronic medical records affected by this leak?

No, patient electronic medical records (EPR) were not exposed. The leak specifically targets the FHF's partner and membership directory, which contains contact details for healthcare administrators and institutional representatives rather than patient clinical files.

Could a similar threat affect your organization?

If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.