Hackers reportedly obtained the personal details of a nurse in the French city of Nantes and used this data to create 54,000 working vaccine passes. Meanwhile, the French government says it’s detected 110,000 such fakes to date.
The nurse’s story was reported by Ouest-France on Thursday, with the news site claiming that all the fake passes are now in circulation.
France’s health pass system works similarly to vaccine pass setups in use throughout the EU. The system works by pairing a public key (contained in the QR code on a vaccinated person’s phone) with a private key (held by the hospital, pharmacy or healthcare provider that vaccinated them). Venues checking the validity of someone’s Covid pass scan the code and receive a green tick if it matches the private key and a red cross if it doesn’t.
One private key, such as the one held by the nurse in Nantes, can be used to generate an unlimited number of working vaccine passes, making this information highly valuable to hackers and scammers, some of whom then sell the fraudulent passes online.
Revoking the fake passes presents authorities with an additional problem. To cancel a fake vaccine pass, every pass generated from the same private key must be canceled, meaning new passes have to be created for those actually entitled to them.
The story from Nantes is the latest in a line of similar incidents in France. A pharmacist in nearby Angers said in September that his private key was hacked and used to create 2,700 false passes, which he discovered when he noticed an unusually high number of requests on the pharmacy computer to authenticate the new passes.
In the suburbs of Paris last month, a doctor was arrested after allegedly selling at least 220 fake passes for the princely sum of €1,000 ($1,132) each.
French Interior Minister Gerald Darmanin said on Thursday that the government has detected 110,000 fake vaccine passes in circulation, and has arrested more than 100 people in connection with the forgeries. Penalties for using a fake pass can stretch to five years in prison, but Darmanin said that authorities will give amnesty to anyone who “recognizes their mistake and gets vaccinated.”
Introduced during the summer, France’s ‘health pass’ system requires citizens to present proof of vaccination or a negative coronavirus test to access bars, restaurants, shopping malls or public transport, among other locations. The system has proven controversial, and thousands of protesters have flooded the streets of Paris and other major cities almost every weekend since its introduction. As of January, all adults in France will need a booster shot to keep their health pass valid.