French Hospital Fined €500,000 After 2025 Breach Exposed Data of 727,000 People
Summary
France’s CNIL fined Hôpital privé de la Loire €500,000 after a 2025 breach exposed data of more than 727,000 patients and trusted third parties. Investigators cited weak access controls, missing VPN and MFA, and inadequate monitoring.
Key points
- CNIL said the 2025 breach exposed data belonging to 524,867 patients and 202,246 trusted third parties.
- An attacker accessed and extracted data from the hospital’s electronic patient record system over several days.
- CNIL found external users could access the system without a VPN or multi-factor authentication, and a compromised account could reach all patient records.
- The hospital lacked timely monitoring and alerting; CNIL also said it did not directly notify the affected trusted third parties.
- The authority fined the hospital €500,000 for GDPR security and notification violations; it noted the hospital strengthened security during the proceedings.
- A teen using the alias “Marak” claimed responsibility and said the attack began with a doctor’s account; reports said the stolen data was neither sold nor published.
Article Details
- Victim Organization
- Hôpital privé de la Loire
- Incident Type
- Data breach involving unauthorized access to the electronic patient record system and extraction of sensitive data.
- Incident Date
- 2025-06-01
- Data Types Exposed
- Sensitive patient data
- Sensitive data of trusted third parties
- Affected Records
- 727,113 people: 524,867 patients and 202,246 trusted third parties.
- Operational Impact
- The attacker accessed hospital records and extracted data over several days without detection. No service disruption is reported.
- Ransom Or Extortion
- The hacker using the alias “Marak” claimed responsibility and reportedly attempted to sell the stolen data to one buyer for €2,000–€5,000. It was later reported that the data was neither sold nor published.
- Claim Status
- confirmed