Centre Ellipse claims data breach by Akira ransomware group

• Ransomware group: Akira
• Country: France
• Sector: Healthcare
• Announcement date: June 9, 2026

Akira ransomware group claims compromise of Centre Ellipse

The Akira ransomware group has announced that it has successfully compromised data belonging to the medical facility Centre Ellipse. According to an announcement made on a leak site on June 9, 2026, the threat actor group claims to have exfiltrated a significant volume of corporate information from the French healthcare provider.

The Akira group, which has been active as a ransomware-as-a-service (RaaS) operation since early 2023, has claimed to have stolen 142 GB of data from the organization. The group has indicated that the stolen data is scheduled to be published in the near future. Akira is recognized by security researchers for utilizing double extortion tactics, a method where attackers not only encrypt an organization's systems but also threaten to leak sensitive data to pressure the victim into paying a ransom. This group frequently gains initial access to victim networks by leveraging compromised VPN accounts.

Data involved in the alleged breach

While no screenshots have been provided to verify the contents of the stolen files, the group claims that the exfiltrated data contains highly sensitive information. The alleged leak includes records pertaining to at least 500 patients, alongside various internal corporate documents. The specific categories of data mentioned in the claim include:

• Patient health records
• Employee personal data
• Financial records
• Contracts
• Confidential agreements

The presence of such diverse data types suggests a broad compromise of the organization's digital environment, covering both clinical and administrative functions.

About Centre Ellipse

Centre Ellipse is an ambulatory medical facility located in France. The center specializes in providing personalized care pathways for patients suffering from various chronic diseases or syndromes. Its medical services focus heavily on cardiac rehabilitation and mental health services. To support its patients, the facility utilizes a multidisciplinary team to provide both physical and psychological support.

Potential impact and industry implications

This alleged breach poses a significant risk due to the potential exposure of sensitive patient health information. Because the target is a medical facility, the organization could face intense regulatory scrutiny and potential legal consequences under strict data protection frameworks such as the General Data Protection Regulation (GDPR). The exposure of such sensitive information can lead to severe consequences for both the institution and the individuals affected.

The stolen data could be utilized by malicious actors for identity theft or for conducting highly targeted phishing campaigns against the patients and employees of the facility. Furthermore, the disclosure of confidential business documents, such as contracts and agreements, could lead to significant operational disruptions for the center. The use of a double extortion model by the Akira group means that the threat of publishing this data can cause lasting reputational damage to the institution.

In the broader context of cybersecurity, ransomware attacks on healthcare providers highlight the critical need for robust defensive measures. Organizations in this sector often face heightened risks because the data they hold is highly valuable on the dark web. To mitigate such risks, it is common practice for organizations to implement multi-factor authentication (MFA) to protect remote access points like VPNs, maintain rigorous patch management schedules, and conduct regular offline backups of critical data. Additionally, continuous monitoring of network traffic and employee security awareness training are essential components of a modern defense-in-depth strategy designed to prevent initial access and detect exfiltration attempts before they result in a public leak.