France’s privacy regulator has fined a private hospital €500,000 after an attacker used a doctor’s credentials to access its electronic patient-record system and extract data belonging to hundreds of thousands of people.
The Commission nationale de l’informatique et des libertés, better known as the CNIL, announced the penalty against Hôpital Privé de la Loire on September 3, 2026.
The breach exposed records associated with 524,867 patients and another 202,246 people who had been identified by patients as trusted contacts.
But the CNIL did not fine the hospital simply because it was hacked.
Its investigation found that several basic security controls were missing or insufficient before the attack, including multifactor authentication for outside users, VPN protection for external access, appropriate restrictions on which patient files individual users could see, and systems capable of quickly detecting suspicious activity inside the hospital’s electronic patient record platform.
The regulator also found a second GDPR violation after the breach: although affected patients were notified, more than 202,000 trusted contacts whose personal information had also been stolen were not directly informed.
For healthcare organizations, the decision is a useful example of how European regulators increasingly separate two questions after a cyberattack.
Did a breach happen?
And did the organization take reasonable measures before it happened to reduce the likelihood and potential impact of that breach?
Under the GDPR, those are not the same question.
The Attacker Used a Doctor’s Account
Hôpital Privé de la Loire is located in Saint-Étienne and has been part of the Ramsay Santé group since 2008.
The hospital treated approximately 50,000 patients during 2024 and maintains an electronic patient record system that centralizes information about people receiving care.
By 2025, the system contained records concerning roughly 530,000 patients.
According to the CNIL’s formal decision, the attack began on June 26, 2025.
The attacker gained access using credentials associated with an independent physician affiliated with the hospital.
Once inside, the attacker began sending requests to the application to understand how the system worked and how its records were organized.
Between June 26 and July 1, the attacker extracted 524,867 patient files.
The information involved was substantial.
The compromised records contained information that could include:
- names and civil-status information;
- dates and places of birth;
- Social Security numbers;
- postal and electronic contact information;
- permanent patient identification numbers;
- family and employment information;
- trusted-contact information;
- identification documents; and
- health information in certain records.
The CNIL’s decision provides additional detail about the scale.
Of the patient records extracted, 46,185 contained the front of a national identity card belonging to the patient or legal representative.
Forty-three included health data.
And 202,246 contained information relating to a patient’s designated trusted person, including the person’s name, relationship to the patient and telephone number.
The hospital discovered the problem after a physician reported on July 1 that he could no longer access the patient-record system.
The hospital notified the CNIL of the breach on July 4.
The regulator subsequently received nine complaints and opened an investigation.
Hundreds of Outside Users Could Connect Without MFA
One of the clearest findings concerned authentication.
Hospital employees accessing the patient-record system remotely generally connected through a VPN.
But the same protection was not required for a much larger group of external users.
Approximately 450 outside users, including independent physicians, their administrative staff and employees of the software provider responsible for maintaining the system, could connect to the electronic patient record application directly over the internet.
They did not first have to connect through a VPN.
The hospital also did not require multifactor authentication for those external connections.
That meant possession of a valid username and password could provide a route into a system containing hundreds of thousands of patient records.
According to the CNIL, the attacker exploited precisely that weakness.
The regulator concluded that the hospital’s authentication procedure for external users was not sufficiently robust given the sensitivity and volume of the information stored in the system.
This is an important point for companies interpreting Article 32 of the GDPR.
The regulation does not contain a sentence saying every organization must use MFA for every system.
Instead, Article 32 requires controllers and processors to implement technical and organizational measures appropriate to the risk.
Those measures have to be evaluated in light of factors including the nature of the information, the purposes of the processing, available technology and the potential consequences for individuals.
A database containing hundreds of thousands of medical records produces a very different risk profile from an ordinary internal application.
The higher the potential harm, the harder it becomes to justify weak authentication.
One Compromised Account Could Reach the Entire Patient Population
Authentication was only the first problem.
Once the attacker entered the system, the hospital’s access-control structure allowed that single account to reach far more information than the user should have needed.
The CNIL said the hospital’s authorization policy did not adequately account for the concept of the patient’s care team.
In practical terms, access should have been limited so that medical professionals could obtain information about the patients whose treatment they were actually involved in.
Instead, the compromised credentials allowed the attacker to access information concerning the hospital’s entire patient population.
That transformed the compromise of one account into a breach involving more than half a million patient records.
This is the difference between authentication and authorization.
Authentication asks:
Who are you?
Authorization asks:
What are you allowed to see once we know who you are?
Organizations frequently concentrate heavily on the first question while neglecting the second.
Even strong authentication does not eliminate the need for least-privilege access.
If every authenticated account can reach substantially more information than its user needs, one compromised account can become a gateway to the entire database.
Healthcare systems make that problem especially serious because patient records routinely contain information subject not only to privacy laws but also to professional medical confidentiality.
The Attacker Remained Inside the System for Days
The hospital also lacked adequate monitoring to identify what was happening after the attacker logged in.
According to the CNIL, the hospital had not implemented measures capable of identifying suspicious activity within the patient-record system in real time or shortly afterward and triggering an appropriate alert.
That allowed the attacker to explore the application and extract a large amount of information over several days without the unusual behavior being detected.
This part of the case is particularly relevant because modern security incidents increasingly turn on detection time.
Preventive controls will fail occasionally.
A password can be stolen.
An employee can be phished.
A software vulnerability can be exploited.
An authorized account can be abused.
The next question is whether systems recognize behavior that does not make sense.
A physician account suddenly requesting hundreds of thousands of patient records should look different from ordinary clinical activity.
That is where logging, behavioral monitoring, rate limits and automated alerts become privacy controls as well as cybersecurity controls.
The CNIL concluded that the absence of effective detection contributed to the scale of the incident.
The attacker was not merely able to enter the system.
The attacker was able to remain there long enough to extract an enormous dataset.
The GDPR Does Not Require Perfect Security
One of the most useful parts of the CNIL’s formal decision is what the regulator did not say.
A breach does not automatically prove that an organization violated the GDPR.
The CNIL expressly acknowledged that Article 32 creates a risk-based obligation rather than an absolute guarantee against cyberattacks.
It cited Court of Justice of the European Union decisions establishing that controllers must take appropriate technical and organizational measures to mitigate data-security risks, but they are not expected to eliminate every possibility of a breach.
That distinction matters.
A sophisticated attacker can sometimes compromise a well-secured organization.
The existence of an attack, by itself, does not establish negligence or a GDPR violation.
Regulators instead look at the environment that existed before and during the attack.
Was MFA available?
Were remote connections appropriately protected?
Were privileges limited?
Were sensitive records segmented?
Was suspicious activity logged?
Could unusual access patterns trigger alerts?
Were security measures periodically reviewed?
In this case, the CNIL concluded that weaknesses in several of those areas made the attack easier and increased its eventual impact.
The regulator described some of the missing safeguards as elementary security measures.
Healthcare Data Raises the Standard
The nature of the information also affected the CNIL’s assessment.
Article 32 requires security appropriate to the risk, and medical records present unusually high risks if accessed by unauthorized parties.
The hospital’s system contained government identifiers, patient identity information and medical information.
French law also imposes security requirements on digital healthcare services.
The CNIL’s formal decision noted that when processing involves special categories of information such as health data, stronger safeguards are required.
That does not mean every healthcare system must use exactly the same architecture.
It means the security controls should reflect what would happen if the system were compromised.
The more sensitive the information and the larger the population affected, the harder it is to defend a system that relies primarily on usernames and passwords while providing broad access to records.
The Hospital Also Failed to Notify More Than 202,000 People
The security failures were not the hospital’s only GDPR problem.
Following the breach, Hôpital Privé de la Loire notified affected patients.
But the attacker had also obtained personal information concerning 202,246 people who patients had listed as trusted contacts.
Those individuals were not directly notified.
The CNIL found that this violated Article 34 of the GDPR.
Article 34 generally requires a controller to communicate a personal-data breach to affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
The purpose is not simply administrative.
People need sufficient information to understand what happened and take steps to reduce the risk of subsequent misuse.
The CNIL said the failure to contact the trusted third parties deprived them of information about the nature and likely consequences of the attack, as well as measures they could take to protect themselves.
This exposes another common breach-response problem.
Organizations sometimes identify the most obvious class of victims and stop there.
A compromised system can contain information about people who were never customers, employees or account holders.
Emergency contacts.
Family members.
Dependents.
Beneficiaries.
References.
Authorized users.
Caregivers.
Those people may still be data subjects under the GDPR.
A proper breach investigation therefore needs to identify whose information was affected, not simply whose account or primary record was compromised.
The €500,000 Fine Was Based on More Than the Number of Records
The CNIL’s restricted committee imposed a €500,000 administrative fine.
In determining the penalty, the regulator said it considered the hospital’s failures involving fundamental security principles, the number of people affected, the nature of the compromised information and the hospital’s financial capacity.
The hospital reported revenue of approximately €93.4 million for the July 2024 through June 2025 period, according to the formal decision. It also recorded a net loss of approximately €5.2 million during that period.
The CNIL also acknowledged that the hospital strengthened its security during the enforcement proceedings.
The regulator nevertheless ordered the organization to complete additional measures, with deadlines ranging from three to 15 months depending on the required control.
The case therefore did not end when the fine was paid.
The hospital remains responsible for finishing its remediation program.
What Healthcare Organizations Should Take From the Decision
The technical problems identified by the CNIL are not exotic.
That is what makes the case useful.
This was not an enforcement action built around a novel interpretation of the GDPR.
The regulator identified familiar security fundamentals:
strong authentication;
protected remote access;
least-privilege authorization;
and timely detection of abnormal activity.
For organizations handling health information, those controls should be reviewed together.
MFA can reduce the likelihood that stolen credentials provide access.
Access controls can limit the damage if those credentials are nevertheless compromised.
Monitoring can identify abuse if an attacker gets past both.
Each layer assumes the previous one might fail.
The hospital case shows what happens when several layers fail at once.
Privacy Compliance Does Not Stop at the Privacy Notice
The enforcement action is also another reminder that GDPR compliance is not primarily a documentation exercise.
An organization can maintain a privacy policy, processing register, data protection officer and breach-response procedure and still violate the GDPR if the technical environment does not provide security appropriate to the risks.
For healthcare companies, that means privacy teams need visibility into security architecture.
Who can remotely access patient records?
Is MFA mandatory?
How are third-party clinicians authenticated?
Can one practitioner view patients outside their treatment relationship?
What activity is logged?
What volume of records can one account access before an alert is generated?
How quickly can a compromised account be disabled?
And if an incident happens, does the organization know every individual whose information was exposed?
Those are not merely IT questions.
Under the GDPR, they can become enforcement questions.
Hôpital Privé de la Loire was not fined because France expects hospitals to build systems that can never be hacked.
It was fined because the CNIL concluded that a system holding some of the most sensitive information an organization can possess did not have safeguards proportionate to that risk.
That distinction is worth remembering whenever a business says that no cybersecurity system can provide 100% protection.
The GDPR does not demand 100%.
It does demand that the controls make sense for the data being protected.