French Hospital Data Breach Draws €500,000 Fine Over 727,000 Records

France's data protection regulator has fined a French hospital €500,000 over a data breach involving more than 727,000 people. The exposed records covered patients and the relatives they had named as contacts. CNIL published the decision on 3 September 2026, closing an investigation into an intrusion from the summer of 2025. The regulator found that Hôpital privé dela Loire failed to protect the system holding every patient file it kept.

The hospital sits in Saint-Étienne and forms part of the Ramsay Santé group. It runs 333 beds across five clinical divisions and employs 650 staff, including 180 doctors. Around 60,000 people pass through it each year. An attacker reached the records of 524,867 patients and another 202,246 individuals registered as trusted third parties.

Three Missing Controls Turned One Login Into 727,000 Records

CNIL built its case around Article 32 of the GDPR. That article requires security measures suited to the risk. The regulator traced the data breach at the French hospital to three separate gaps in its electronic patient record system. Each gap made the next one more damaging.

External users signed in without a VPN and without multi-factor authentication. Private-practice physicians connected to patient files that way as a matter of routine, and the attacker used the same route.

Access rights compounded the problem. The authorisation policy ignored the care-team principle, so clinicians were not limited to the patients they actually treated. One set of stolen credentials therefore reached every record the hospital held. Ward and department boundaries counted for nothing.

Detection Was the Deciding Failure

The third gap decided the scale. The hospital ran no real-time or near real-time detection on activity inside the record system, and no alert fired when one account began pulling files in bulk.

That silence gave the attacker room to work. He explored the environment for several days and extracted a very large volume of data without interruption. CNIL pointed to the missing detection as the reason the data breach at the French hospital grew to the size it did.

How the Data Breach at the French Hospital Started

CNIL's decision does not name the person behind the data breach at the French hospital. Reporting from the time attributes the intrusion to a teenager using the alias Marak, who contacted French media over Telegram in July 2025. He said the attack began with one compromised doctor's account. That single login then opened the hospital's wider internal systems.

Those claims remain unverified. The attacker also reportedly tried to sell the stolen dataset to a single buyer for between €2,000 and €5,000. Later reporting indicated that no sale went through and that the files never appeared publicly. Nobody can account for copies that may still exist.

The 202,246 People the Hospital Never Contacted

The second violation concerns how the French hospital handled notification after the data breach. Article 34 of the GDPR obliges organisations to tell people directly when an incident puts them at high risk. HPL informed its patients. It said nothing to the 202,246 trusted third parties whose personal data the attacker also took.

A trusted third party in the French system speaks for a patient or receives information about their care. These people never handed their details to the hospital themselves. Somebody else did it on their behalf, so few of them would think to watch a hospital they never visited.

CNIL ruled that the omission left them without the facts needed to understand the attack and limit misuse of their data. That matters more than the procedural language suggests. People who never learn of their exposure cannot look out for the phishing calls and impersonation attempts that follow a health data leak.

What the Penalty Reflects

CNIL weighed four factors when it priced the data breach at the French hospital. The first two were the disregard for basic security principles and the number of people affected. The others were the sensitivity of health records and the hospital's own financial capacity. The restricted committee adopted the decision on 21 July 2026 and made it public six weeks later.

The French hospital did strengthen its security after the data breach came to light, and the regulator credited that work. CNIL also set deadlines for the measures still outstanding. They run from three to fifteen months, depending on the type of control.

Why Patient Records Keep Drawing Attackers

Health data holds value long after a password reset. Names, addresses, diagnoses, and treatment histories cannot be reissued, so a stolen medical file supports fraud and impersonation for years. Criminals also use medical detail to make impersonation calls sound credible. A caller who knows about a recent procedure rarely gets questioned.

The data breach at this French hospital fits a wider pattern across European healthcare. Regulators have responded with heavier penalties. CNIL has been active on several fronts this year, including its review of an intrusion into France's tax systems.

What Other Organisations Should Take From It

Nothing exotic appears in CNIL's findings. Multi-factor authentication on external access, scoped permissions, and alerting on unusual record activity are standard controls. The hospital had none of them in place. Three ordinary defences would have contained the data breach at this French hospital well before it reached 727,000 people.

Organisations holding sensitive records can treat the decision as a checklist. Every failure CNIL named describes a control a security team can test this week. The notification finding carries its own warning. That duty covers everyone whose data sits in the file, not only an organisation's own customers.