SOS Oxygène · Breach

[Single source] Actor claims exposure of medical data from 15,000 patients

Nov 10, 2026 · 1 min read

An actor claims to have exploited a vulnerability at SOS Oxygène and offered a 22 MB dataset for sale. The data allegedly includes personal, medical, and insurance information for 15,171 patients. The item does not include confirmation from the company.

By HIFY Radar newsroom Updated 11/10/2026 12:58 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In 30 seconds

Alleged

The latest available evidence leaves the incident unconfirmed. A post says an actor called "morphyn1337" is selling data allegedly taken from 15,171 SOS Oxygène patients, but the post itself labels the claim unverified.

What happened

Alleged

According to DarkWebInformer, the actor claims to have exploited a vulnerability affecting the French home oxygen and respiratory care provider. The actor allegedly published a sample and offered the complete dataset for $300.

Why it matters

Inferred

If authentic, the collection would combine identity, contact, insurance, prescription and treatment information. That mix could expose patients to privacy harms and targeted fraud, although those consequences remain conditional because the dataset has not been independently verified.

What to do

Inferred

Patients should treat the report as unconfirmed rather than assume they were affected. Anyone who receives messages referring to SOS Oxygène, prescriptions, insurance or treatment details should verify the sender through a trusted contact channel before sharing information or making a payment.

Confirmed and still uncertain

Observed

What is visible is a public post describing the alleged sale and explicitly warning that the claim is unverified. The supplied evidence does not establish that SOS Oxygène was breached, that the sample is genuine, that 15,171 records exist, or that the company confirmed an incident.

What people are saying

Observed

DarkWebInformer says the actor uses the handle "morphyn1337" and claims responsibility for exploiting a vulnerability. The account does not endorse that account as proven and instead describes it as unverified.

Evolution

Alleged

The reported sequence begins with the actor's alleged vulnerability claim, continues with the purported publication of a sample and a $300 sale offer, and ends, in the available evidence, with a third-party post circulating the story while cautioning that it remains unverified.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The post describes the alleged files as containing names, addresses, contact details, birth dates, insurance information, healthcare provider and prescription data, plus care, delivery and treatment records. It offers no technical explanation of the supposed vulnerability or independent forensic evidence linking the material to SOS Oxygène.

Sources and evidence

Observed

The evidence batch contains one X post from DarkWebInformer and an associated image. There is no company statement, regulator notice, forensic report or independently authenticated dataset in the supplied material, so the breach, attribution and reported patient count remain allegations.