French Hospital Fined €500,000 After Patient-System Breach Exposes 727,000 People

France’s data-protection authority, CNIL, fined Hôpital privé de la Loire (HPL) €500,000 over a 2025 breach in which an attacker used a compromised doctor’s account to access its electronic patient-record system. The incident exposed sensitive data for 524,867 patients and 202,246 trusted third parties—more than 727,000 people in total. A person using the alias “Marak” claimed responsibility; three suspects were arrested in late June in connection with attacks on automated data-processing systems.

CNIL found that HPL allowed remote access without a VPN or multifactor authentication, assigned overly broad permissions that enabled one compromised account to reach all patient records, and lacked monitoring capable of promptly detecting prolonged exploration and exfiltration. The authority also found that HPL failed to directly notify affected third parties, violating GDPR Articles 32 and 34. HPL has been ordered to correct the identified deficiencies within deadlines ranging from three to 15 months.