GoKawiilCNIL fines Hôpital privé de la Loire €500,000 over 727,000-record breach
France's data protection authority CNIL has fined Hôpital privé de la Loire €500,000 after a 2025 breach exposed data belonging to over 727,000 people, including more than 524,000 patients and roughly 202,000 people listed as trusted contacts. Investigators found the hospital allowed external users to log in without VPNs or multi-factor authentication, gave a single compromised account access to all patient records, and had no real-time monitoring to catch the intrusion as it unfolded over several days.