French hospital fined €500,000 after breach exposes data of 727,000

France’s data protection authority (CNIL) has fined Hôpital privé de la Loire €500,000 ($580,000) for failing to adequately protect patients’ and their relatives’ data.

The French agency says that the security failures led to a data breach in the summer of 2025, exposing sensitive data belonging to 524,867 patients and another 202,246 people designated as trusted third parties.

Hôpital privé de la Loire (HPL) is a general hospital in Saint-Étienne, part of the Ramsay Santé healthcare group, providing medical, surgical, maternity, cancer, intensive-care, and emergency services.

The hospital employs a staff of 650, including 180 doctors, and has 333 beds across five clinical divisions, with a reported 60,000 patients yearly.

Last year, an attacker accessed the hospital’s electronic patient record system and extracted sensitive data of more than 727,000 people who had received care at HPL, escorted patients there or helped them in some way.

Following the incident, the CNIL conducted an investigation, which identified several failures to comply with the hospital's obligations under the General Data Protection Regulation (GDPR).

Some of the shortcomings CNIL’s investigation identified include:

• External users, including private-practice physicians, could access the system without a VPN or multi-factor authentication.
• Inadequate access controls allowed the compromised account to access records for all hospital patients.
• The hospital lacked real-time or near-real-time monitoring and alerting, allowing the attacker to explore the system and extract a large volume of data over several days without detection.
• The hospital informed affected patients but did not directly notify the 202,246 trusted third parties whose data was also stolen.

The violations above relate to Article 32 and Article 34 of the GDPR. The committee also noted that HPL took several security strengthening measures during the proceedings.

A teen hacker using the alias “Marak” claimed responsibility, contacting the French outlet Le Progrès over Telegram at the time and saying the attack began with a breach of a single doctor’s account, which allowed access to HPL’s entire internal system.

The hacker attempted to sell the stolen data to a single buyer for a price between €2,000 and €5,000, although it was later reported that the data was neither sold nor published.