€500,000 Fine: French Hospital Failed to Protect the Data of 727,000 People

France's data protection authority (CNIL) has fined the private hospital Hôpital privé de la Loire (HPL) in Saint-Étienne 500,000 euros (about 580,000 dollars) for failing to adequately protect the personal data of its patients and their loved ones. The hospital is part of the Ramsay Santé network, has 333 beds and admits roughly 60,000 patients a year.

What happened

In the summer of 2025, an attacker gained access to the electronic medical records system and spent several days exfiltrating data. The breach affected 524,867 patients and a further 202,246 people listed as trusted third parties — those accompanying or assisting the patients. In all, the information of more than 727,000 people was put at risk.

Responsibility for the attack was claimed by a teenager operating under the alias “Marak.” He contacted the newspaper Le Progrès via Telegram and explained that it had all started with the compromise of a single doctor's account, which opened up access to the hospital's entire internal system. The hacker tried to sell the stolen data to a single buyer for somewhere between 2,000 and 5,000 euros, though according to later reports the data was ultimately neither sold nor published.

The regulator's findings

The CNIL investigation uncovered a whole series of violations of GDPR requirements — in particular Articles 32 and 34. External users, including doctors in private practice, were able to connect to the system without a VPN or multi-factor authentication. Access rights were segmented so carelessly that a single compromised account granted access to the records of every patient at the hospital.

On top of that, the hospital had no real-time or near-real-time monitoring: this is precisely why the attacker was able to roam the system unimpeded for several days and exfiltrate large volumes of information without raising an alarm. Finally, HPL notified the affected patients of the incident but did not directly inform the 202,246 trusted contacts whose data had also been stolen.

As a mitigating factor, the regulator took into account that during the proceedings the hospital adopted a number of measures to strengthen its defenses. Tellingly, basic measures — mandatory multi-factor authentication and sensible access segmentation — could have significantly limited the scope of the incident before it ever turned into a breach affecting hundreds of thousands of people.

Source: Bleeping Computer