Hôpital Privé de la Loire – €500,000 Fine (France, 2026)

In June 2025, an attacker obtained the credentials of a doctor affiliated with Hôpital Privé de la Loire, the controller, and used them to access the hospital's electronic patient record system. Between 26 June and 1 July 2025, the attacker extracted 524,867 patient records. The compromised data included identification and contact information, social security numbers and, in some cases, identity documents and health data. The records also contained personal data relating to 202,246 persons designated by patients as trusted third parties. After discovering the breach, the controller notified the CNIL, the DPA, and informed the affected patients through different communication channels. However, it did not directly inform the 202,246 trusted third parties whose data had also been compromised. The DPA subsequently carried out an on-site investigation into the controller's data processing practices. The investigation identified several security deficiencies in the electronic patient record system. External users could access it remotely using only a username and password, without a VPN or multi-factor authentication. Moreover, healthcare professionals could access patient records of patients they had no relation with, the system lacked adequate proactive analysis of access logs, and the software provider had permanent access to the system without prior authorisation by the controller. Following the breach, the controller had also temporarily assigned the same password to all external practitioners when resetting their credentials. The DPA found that the controller violated Article 32 GDPR by failing to implement appropriate technical and organisational measures to secure the electronic patient record system. The DPA first considered that remote access by external practitioners was insufficiently protected because it relied only on a username and password, without multi-factor authentication or a VPN. Given the sensitivity and volume of the health data processed, stronger authentication measures were required. The lack of such safeguards also facilitated the breach, as the attacker accessed the system using compromised credentials. The DPA further found that the controller's access-rights policy was too broad, since healthcare professionals could access records of patients for whose care they were not responsible. In addition, although access logs were collected, they were not analysed in real time or shortly afterwards to detect abnormal activity. This allowed the attacker to extract a very large number of records over several days without triggering an alert. The DPA also considered that confidentiality was insufficiently protected because, after the breach, the controller temporarily assigned the same password to all external practitioners. Moreover, the software provider had permanent access to the system without prior authorisation by the controller. The DPA additionally found a violation of Article 34 GDPR because the controller did not directly inform the 202,246 trusted third parties whose personal data had been compromised. A general notice published on the hospital's website was not sufficient to meet the obligation to communicate a high-risk personal data breach to affected data subjects. The DPA fined the controller €500,000 and ordered it to improve log monitoring, revise its access-rights policy and restrict the software provider's access to situations where prior authorisation had been granted. The orders were subject to a penalty payment of €1,000 per day of delay.