CNIL (France) - SAN-2026-009
CNIL fines French healthcare provider €500K for weak MFA, unauthorized vendor access, and inadequate breach
Run CNIL?
Get an email when a reviewed story names CNIL, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
France's data protection authority (CNIL) issued a €500,000 fine to a French healthcare provider for critical security failures in its electronic patient record system. The investigation revealed external users could access the system remotely with only username and password (no MFA or VPN), healthcare staff had excessive access rights, a software vendor had permanent unauthorized system access, and the provider failed to notify 202,246 affected individuals of a data breach. The DPA found violations of GDPR Articles 32 (technical safeguards) and 34 (breach notification), and ordered remediation including improved log monitoring and access control restrictions.
The lesson from this incident
Full lessonA French healthcare provider suffered a significant GDPR enforcement action after investigators found its electronic patient record system was accessible remotely with only a username and password — no MFA or VPN required — leaving highly sensitive patient data exposed to credential-based attacks. Compounding the risk, healthcare staff held excessive access rights and a third-party software vendor retained permanent, unauthorized system access, violating the principle of least privilege. The provider then failed to notify over 202,000 affected individuals of a confirmed data breach, breaching GDPR Article 34's mandatory notification obligations. This case illustrates how layered security failures — weak authentication, poor access governance, unmanaged vendor access, and inadequate incident response — can amplify both the harm to individuals and the regulatory consequences for organizations.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Log management and security data pipelines
Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.