Health Data Breach: €500,000 Fine Imposed on the Hôpital privé de la Loire

On September 3, 2026, the CNIL imposed a fine of €500,000 on the Hôpital privé de la Loire for failing to take appropriate measures to ensure the security of its patients’ data and that of some of their relatives.

In the summer of 2025, an attacker managed to gain access to the electronic health record (EHR) system of the Hôpital privé de la Loire, which centralizes all data on patients receiving care. The attacker thereby gained access to the data of 524,867 patients (including, for some of them, health information) and 202,246 individuals designated as “trusted third parties.”

Following this data breach, the CNIL conducted an audit that revealed several instances in which the Hôpital privé de la Loire failed to comply with the obligations set forth in the General Data Protection Regulation (GDPR). The authentication procedure for logging into the hospital’s EHR system, used by users outside the hospital – particularly private practitioners – was not sufficiently secure due to the lack of a VPN and multi-factor authentication. The attacker exploited this vulnerability to gain access to the data.

Consequently, the restricted panel – the CNIL body responsible for imposing sanctions – imposed a fine of €500,000 on the Hôpital privé de la Loire, taking into account, in particular, the violation of essential security principles, the number of individuals affected, the nature of the compromised data, and the hospital’s financial capacity.