-
A tipster claims Pharmagest pharmacy software runs a remote-control tool whose password is the computer’s own name.
-
The claim remains unverified since no public proof has linked it to recent French pharmacy leaks.
-
Another user says Pharmagest was notified about the problem in September 2025. Pharmagest, however, has yet to render any public statements regarding the claims.
A news account on X that covers hacking made a serious claim on November 5. International Cyber Digest said Pharmagest, a French maker of pharmacy software, leaves patient records reachable from the open internet.
According to the post, the software installs a remote control tool called VNC on every computer it runs on. The tool lets a person see and control a screen from far away. The post says the password is simply the computer’s hostname, which is its network name.
What the Post Claims
International Cyber Digest says anyone on the internet can reach the VNC server. As a result, patient records could be exposed. Remote access tools are not the only security concern for Windows users. In April this year, Microsoft also warned about a WhatsApp malware attack targeting Windows users, highlighting another way attackers can compromise devices. The person who sent the tip says he reported the issue to ANSSI, France’s national cybersecurity agency.
He also says he is almost sure hackers used these weak passwords to steal medical data, but there’s no public evidence to back that point.
A hostname isn’t anything confidential; staff use it to differentiate computers, and names often follow a pattern. So a password built from one would be easy to guess. Still, no outside expert has publicly tested the claim.
The French site Cyberattaque.org says it could not confirm the setup on its own. It also notes that nobody knows whether every machine works this way or only some versions.
A second user, Leo Gonzales, replied to the post. He says his team told the software maker about the same flaw on September 11, 2025. If true, about 14 months passed before this week’s post. Yet no public document backs up that date. Pharmagest may have looked into it or fixed things quietly. For now, the timeline is a claim, not a fact.
Why the Size of Pharmagest Matters
Pharmagest belongs to the Equasens group. Its main product, id., replaced LGPI. Cyberattaque.org reports that the company’s website claims 12,000 pharmacies and 30 million patients. An analyst note from January 2024 said more than 9,000 pharmacies.
France had 19,676 pharmacies at the end of 2024, according to Equasens. Those figures show the company’s reach. They do not show how many computers are at risk, and nobody has given that number.
Pharmacy software holds names, contact details and treatment history. A remote screen session could reveal all of it. That is why security experts treat open remote tools as a serious problem.
Leaks that Raised the Stakes a Notch Higher
It’s tough to brush off the timing here. Hackers announced hits on three pharmacies, Paris, Strasbourg, and Dijon, right around October 31 and November 1. They’re calling themselves “necrozma” and “injecteur,” and they say they’ve grabbed about 436,000 records altogether. Breaking it down, that’s around 303,000 from Paris, 110,000 from Strasbourg, and 23,000 from Dijon. No one’s actually confirmed these numbers yet.
One site checked a 1,000-record sample from the Dijon claim. Of those, 941 included a Social Security number. A sample alone does not prove a theft, though.
How did the attackers get in? The hackers say they used logins for professional tools such as AmeliPro and insurance billing modules. Meanwhile, the head of the USPO pharmacists’ union points to a possible break-in through third party payment operators.
Nothing is proven. Neither idea involves VNC. Also, the coverage reviewed does not name the software those pharmacies use. So no one can link these three attacks to Pharmagest.
CERT-FR, which is part of ANSSI, along with CERT Santé, released a report on weaknesses in health software on October 2. The report covers numerous installations of one health software on the internet without any login system.
Some clients disconnected them, while some retained them after signing a waiver. The report does not identify the supplier, so it cannot be linked to Pharmagest.
The report also mentions a survey carried out by the French digital health agency, which states that 74 percent of respondents mentioned that suppliers had either been slow in eliminating vulnerabilities or refused to do it. At the same time, 90 percent of them did not have any procedures for reporting a flaw to a vendor.
What Happens Next
Pharmagest has mentioned security in the past. In April 2025, they told pharmacies about a VPN option to help protect remote access. But that doesn’t mean everyone’s actually using it. And after searching on Friday, I couldn’t find any public statements from Pharmagest or ANSSI confirming this claim.
If a pharmacy uses the software, they should reach out to their IT provider or Pharmagest support to check how their remote access is set up. Don’t just try to turn off parts of the software on your own—doing that can really mess up your daily work.
Meanwhile, CERT-FR advises against leaving remote control tools open to the internet without strong protection. If a real breach occurred, European privacy rules call for a report to France’s privacy watchdog, the CNIL.
That report is due within 72 hours when possible. Until Pharmagest speaks up, three big questions stay open. How many computers are exposed? Did anyone get in? And did the company fix the flaw?
