GoKawiilFrance’s data protection authority (CNIL) has fined Hôpital privé de la Loire €500,000 ($580,000) for failing to adequately protect patients’ and their relatives’ data.
The French agency says that the security failures led to a data breach in the summer of 2025, exposing sensitive data belonging to 524,867 patients and another 202,246 people designated as trusted third parties.
Hôpital privé de la Loire (HPL) is a general hospital in Saint-Étienne, part of the Ramsay Santé healthcare group, providing medical, surgical, maternity, cancer, intensive-care, and emergency services.
The hospital employs a staff of 650, including 180 doctors, and has 333 beds across five clinical divisions, with a reported 60,000 patients yearly.
Last year, an attacker accessed the hospital’s electronic patient record system and extracted sensitive data of more than 727,000 people who had received care at HPL, escorted patients there or helped them in some way.
Following the incident, the CNIL conducted an investigation, which identified several failures to comply with the hospital's obligations under the General Data Protection Regulation (GDPR).
Some of the shortcomings CNIL’s investigation identified include:
External users, including private-practice physicians, could access the system without a VPN or multi-factor authentication.
Inadequate access controls allowed the compromised account to access records for all hospital patients.
The hospital lacked real-time or near-real-time monitoring and alerting, allowing the attacker to explore the system and extract a large volume of data over several days without detection.
... continue reading