CNIL (France) - SAN-2026-009
CNIL fines French hospital €500K for inadequate security measures enabling patient data breach.
Run CNIL?
Get an email when a reviewed story names CNIL, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
France's CNIL issued a €500,000 fine against Hôpital Privé de la Loire for violating Article 32 GDPR by failing to implement adequate technical and organizational security measures. An attacker exploited weak remote access controls (no MFA or VPN) to extract 524,867 patient records between June-July 2025. The hospital also failed to notify 202,246 trusted third parties whose data was compromised, violating Article 34 GDPR notification requirements.
The lesson from this incident
Full lessonHôpital Privé de la Loire suffered a large-scale data breach because remote access to its systems lacked fundamental controls — no multi-factor authentication and no VPN requirement — allowing an attacker to freely exfiltrate over half a million patient records across two months. Healthcare environments are high-value targets precisely because of the sensitivity of patient data, yet basic access hardening was absent. Compounding the breach, the hospital failed to notify more than 200,000 affected individuals as mandated by GDPR Article 34, turning a security failure into a dual regulatory violation. This case illustrates that technical negligence and poor incident response planning together dramatically amplify both harm to individuals and legal exposure for organizations.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Zero trust network access (ZTNA)
Remote access no longer means exposing VPN appliances to the internet.