Threat watch / Breach
Softway Medical: data breach on One Manager, its radiology information system
Softway Medical, a French healthcare software publisher, said on November 8, 2026 that a malicious act caused a data breach on One Manager, its radiology information system (RIS). It says it stopped the breach, notified every affected client and suspended some remote access, while the software stays fully functional. It has not said how the attackers got in, which data was involved, or how many radiology centres or patients are concerned. On November 13 the CHU de Reims confirmed that its patients are affected.
- Sector
- Health
- Way in
- Not public yet
- Product or vendor
- Softway Medical One Manager
- How it happened
- Not public. Softway Medical only says that "despite these measures, malicious actors managed to carry out this data breach" and that an in-depth analysis of the causes is under way with cybersecurity partners.[1][2] Checked 13 Nov 2026
- What was stolen
- Not public yet Checked 13 Nov 2026
- Who was impacted
- Radiology clients of One Manager that Softway Medical notified; it says clients that received no notification are not concerned. Some remote access was suspended and reopens gradually during the week of November 9. The CHU de Reims confirmed on November 13 that it is affected: patients who used the remote access to imaging results between October 2019 and April 2026, when the hospital stopped using the software. It says many radiology practices and healthcare facilities in France may also be affected. The number of clients and patients concerned is not public.[1][2][3][5][6] Checked 13 Nov 2026
- Threat actor
- Not attributed
Timeline
- Softway Medical announces it was the victim of "a malicious act that led to a data breach" on One Manager. It says the breach was stopped, all affected clients were notified at once, and only some access is suspended. [1][2]
- Hospimedia reports the cyberattack, which targeted the One Manager RIS, and notes that the publisher says nothing more about the scope of the breach. [3]
- Cyberattaque.org reports that the date and duration of the intrusion, the data categories and whether files were extracted have not been disclosed. [4]
- The CHU de Reims confirms it is affected by the Softway Medical breach, after the publisher's data protection officer told it on November 8. It says medical results and billing and financial data are not concerned, that the exact data categories depend on Softway's investigation, and that it notified the CNIL and will file a complaint. The way the attackers got in is still not known. [5][6][7]