France's data protection authority, CNIL, has imposed a €500,000 fine on Hôpital privé de la Loire (HPL) following a data breach in the summer of 2025 that exposed sensitive information belonging to over 727,000 individuals. The penalty, equivalent to approximately $580,000, was levied due to the hospital's failure to adequately protect patient data and information pertaining to their designated third parties.
HPL, a general hospital located in Saint-Étienne and part of the Ramsay Santé healthcare group, provides a range of medical services, including surgery, maternity, cancer treatment, and emergency care. The breach impacted 524,867 patients and an additional 202,246 individuals identified as trusted third parties, such as escorts or assistants.
The CNIL's investigation, initiated after the incident, identified several violations of the General Data Protection Regulation (GDPR), specifically Articles 32 and 34. Key shortcomings included the absence of multi-factor authentication and VPN requirements for external users, such as private-practice physicians, accessing the hospital's electronic patient record system.
Furthermore, the investigation revealed inadequate access controls, which allowed a compromised account to access records for all hospital patients. The hospital also lacked real-time or near-real-time monitoring and alerting capabilities, enabling the attacker to navigate the system and extract a significant volume of data over several days without detection.
While HPL notified affected patients, the CNIL noted that the 202,246 trusted third parties whose data was also compromised were not directly informed. During the course of the proceedings, HPL reportedly implemented several security enhancements.
A hacker operating under the alias "Marak," described as a teenager, claimed responsibility for the attack. Marak reportedly informed a French news outlet via Telegram that the breach originated from the compromise of a single doctor's account, which then provided access to HPL's entire internal system. The hacker allegedly attempted to sell the stolen data to a single buyer for a price between €2,000 and €5,000, though subsequent reports indicated the data was neither sold nor published.
