CNIL Fines French Hospital €500K: 727,000 Profiles Exposed Without MFA or VPN

On September 3, 2026, the Commission nationale de l'informatique et des libertés (CNIL) fined Hôpital privé de la Loire (HPL) €500,000 for GDPR violations. The penalty stems from a data breach in summer 2025 that exposed the data of 727,113 people, including 524,867 patients and 202,246 trusted third parties, due to a combination of elementary security architecture failures. The attacker gained access to the electronic health record system by exploiting valid credentials without any subsequent verification.

How Access Worked: A Single Credential, No Boundaries

The attacker compromised the account of a single physician, according to the cited source. From that point, the system placed no architectural barrier to escalation. Inadequate access controls allowed the compromised account to consult records of all patients, violating the principle of medical secrecy.

Access occurred from positions external to the institutional network. External users, including independent physicians, connected without VPN and without multi-factor authentication. The combination of single-factor authentication and absence of network segmentation turned a credential compromise into a total data breach.

HPL is a mid-sized facility: 650 employees, 180 physicians, 333 beds across five clinical divisions, approximately 60,000 patients annually. The scale of the damage is not proportional to the size of the infrastructure: a single unprotected entry point made the entire EHR database accessible.

The Attacker Profile and the Healthcare Data Market

A hacker using the alias "Marak," described as a teenager, claimed responsibility for the attack by contacting the French daily Le Progrès via Telegram. According to the cited source, the attacker stated that initial access occurred through the compromise of a single physician account.

The monetization attempt was limited. The attacker offered the data to a single buyer for a price between €2,000 and €5,000. The source reports that the data does not appear to have been either sold or published, but definitive confirmation of the current status is not available.

The attacker's real identity remains unverified. The alias "Marak" and the declared age range have not been confirmed by independent investigative sources. The brief does not specify the precise technical method of the initial compromise: phishing, credential stuffing, or other techniques are not documented.

GDPR Violations: Articles 32 and 34

CNIL found violations of Articles 32 and 34 of the General Data Protection Regulation. Article 32 requires appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Article 34 governs the obligation to communicate the breach to the data subject when it is likely to result in a high risk to their rights and freedoms.

Communication to patients occurred, but with a significant gap: the 202,246 trusted third parties were not informed directly. This highlights a restrictive reading of the notification obligation, limited to direct data subjects rather than extended to third parties whose data was contained in the same database.

Source 3 reports CNIL's formulation: "méconnaissance de principes essentiels en matière de sécurité." The lack of real-time or near-real-time monitoring was decisive in prolonging the incident: the attacker operated for several days before detection, without any system generating alerts on anomalous access or bulk exfiltration.

"France's data protection authority (CNIL) has fined Hôpital privé de la Loire €500,000 ($580,000) for failing to adequately protect patients' and their relatives' data." — BleepingComputer

The Corrective Injunction and the Hospital's Position

Alongside the monetary penalty, CNIL issued an injunction with deadlines of 3 to 15 months for implementing detection mechanisms and updating access policies. This element, reported by source 3, indicates that the authority does not limit itself to retroactive sanctions but imposes a structured remediation path.

Xavier Claris, chairman of the HPL LDA board of directors, stated that the facility is evaluating an appeal to the French Council of State. According to the same source, Claris indicated that some measures, including two-factor authentication, have already been completed. The evaluation of an appeal does not equate to the filing of a formal appeal: the current legal status is that of a final sanction with a potential challenge under evaluation.

What to Do Now

For European healthcare organizations, the HPL case defines a concrete action perimeter. CNIL sanctioned not the complexity of the attack but the predictability of the deficiencies: the absence of MFA for external access, the lack of VPN for non-institutional users, and the deficit in real-time monitoring.

The operational implications translate into three priorities. First: extend multi-factor authentication to all access to the EHR system, including those of independent physicians and external users. Second: implement network segmentation that limits the visibility of a single compromised account to the subset of patients under its purview. Third: activate real-time or near-real-time detection systems for anomalous access, bulk exfiltration, and lateral movement patterns.

Notification to trusted third parties represents a fourth compliance element. Article 34 of the GDPR requires informing data subjects when the breach presents a high risk: the restrictive reading applied by HPL, limited to direct patients, was flagged as an independent violation.

Frequently Asked Questions

Why was the fine issued in 2026 for a 2025 incident?
The interval reflects CNIL's administrative investigation timelines. The source does not specify the exact date of the incident in summer 2025 nor the internal procedural steps.

Was the data actually disclosed?
According to the cited source, the data does not appear to have been either sold or published. Definitive confirmation of the current status is not available in the brief.

Has the hospital already filed an appeal?
No. Xavier Claris stated that the facility is evaluating an appeal to the Council of State. The evaluation does not equate to the filing of a formal legal act.

Sources

• https://www.bleepingcomputer.com/news/security/french-hospital-fined-500-000-after-breach-exposes-data-of-727-000/
• https://radar.offseq.com/threat/french-hospital-fined-500000-after-breach-exposes-data-of-727000-f197ebd48201b531
• https://www.memesita.com/french-hospital-fined-e500k-by-cnil-over-massive-patient-data-breach/
• https://www.secnews.gr/730387/galliko-nosokomeio-prostimo-cnil/