A cyberattack targeting Cegedim Santé's medical software has exposed the data of 15 million patients, triggering a major investigation.