ON 3 September 2026, CNIL announced a €500,000 fine against Loire Private Hospital for failing to implement appropriate security measures to protect patients’ health data. The incident occurred in the summer of 2025 when an attacker gained access to the hospital’s electronic patient record (EPR) system, which holds the data of patients receiving care. In total, data from 524,867 patients were accessed, including health data for some individuals, alongside information pertaining to 202,246 “trusted third parties”.
Following the breach, CNIL conducted an audit which identified multiple security shortcomings and assessed the hospital’s GDPR compliance in light of the exposed data and the scale of impact. The sanction reflects concerns about the fundamental security controls, the number of people affected, the sensitivity of the data involved and the hospital’s financial capacity.
The hospital’s sanction sits alongside reporting from other outlets, which cite a reported line of narrative from sources such as Bleeping Computer about possible details of the intrusion. Those details include claims that the breach began with access to a single doctor’s account and that a teen hacker used a moniker to contact media; however, such points are not confirmed within the CNIL notice itself and should be treated as unverified allegations at this stage.
The CNIL decision emphasises the necessity for robust data security practices across health providers to prevent access to both patient data and information held for third parties.